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VOLUME I 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx-xx-9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer-Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above-entitled matter was 
continued on Monday, June 3, 2013, at 2:10 p.m., at Fort 
Meade, Maryland, before the Honorable Colonel Denise Lind, 
Judge . 
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DISCLAIMER 

This transcript was made by a court 
reporter who is not the official Government reporter, 
was not permitted to be in the actual courtroom where 
the proceedings took place, but in a media room 
listening to and watching live audio/video feed, not 
permitted to make an audio backup recording for 
editing purposes, and not having the ability to 
control the proceedings in order to produce an 
accurate verbatim transcript . 

This unedited, uncertified draft 
transcript may contain court reporting outlines that 
are not translated, notes made by the reporter for 
editing purposes, misspelled terms and names, word 
combinations that do not make sense, and missing 
testimony or colloquy due to being inaudible to the 
reporter . 
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PROCEEDINGS - AFTERNOON SESSION 

THE COURT: Note we are starting a little 

late. I think some of that is just administrative 

processing glitches that we sometimes have on the first 

day of proceedings . 

Major Fein, is the process a little more 

streamlined that we'll be able to start on time? 
MR. FEIN: Yes, ma'am. 

THE COURT: Anything we need to address 
before we begin the merits phase? 

MR . COOMBS : No , Your Honor . 

MR. FEIN: No, Your Honor. 

THE COURT: Call your first witness. 

Whereupon : 

THOMAS SMITH, 
called as a witness, having been first duly sworn 
according to law, testified as follows: 

DIRECT EXAMINATION 

BY MS. OVERGAARD: 

Q. And you are Special Agent Thomas Smith? 

A. Yes, ma'am. 
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Q. And what is your rank? 

A. Sergeant first class, ma'am. 

Q. Where are you currently assigned? 

A. At the Fort Smith CID office. 

Q. What's your position? 

A. I'm the senior enlisted case agent as well as 

the evidence custodian, ma'am. 

Q. And what are the responsibilities of the 

senior enlisted case agent? 

A. As the case agent I'm responsible for the 

daily maintenance of an investigation to include 
conducting crime scene investigation, evidence 
collection. I'm also responsible for the daily 
activities of investigative as far as interviews of 
witness and subjects as well as victims, and also the 
coordination with SJA and command, ma'am. 

Q. And as senior enlisted, does that mean you're 

the most senior case agent? 

A. Yes. 

Q. Most senior enlisted case agent? 

A. Yes, ma'am. 
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Q . And you mentioned you 1 re an evidence custodian 

as well? 

A. Yes, ma'am. 

Q. What do you do in that position? 

A. I'm responsible for the intake or processing, 

accountability, and then final disposition of the 
evidence at the end of the legal proceedings, ma'am. 

Q. And how many years have you been a CID agent? 

A. I graduated from CIDSAC, the special agent CID 

course in June of 2007, ma'am. 

Q. Where were you assigned before Fort Gordon? 

A. I was assigned to the Fort Huachuca. 

Q. And what did you do there? 

A. I was a case agent and then transitioned into 

the senior enlisted case agent there as well, ma'am. 
Q. When were you there? 

A. I arrived there in August of 2008 and I 

departed there in May, June of 2012, ma'am. 

Q. Did you deploy during that time? 

A. I did, ma'am. 

Q. Where did you go? 
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A. I was, I went, to Iraq. I was the detachment 

sergeant for the central Iraq CID detachment . I was 
stationed at VBC, ma'am. 

Q. And that's Camp Victory? 

A. Yes, Victory Based Complex, ma'am. 

Q. And do you remember when that was? 

A. Training was in February, I think we were 

boots on ground in March of 2010, and then I left in 
January of 2011, ma'am. 

Q. And what was your position at camp victory? 

A. I was the detachment sergeant, ma'am. 

Q. What does it mean to be a detachment sergeant? 

A. I was responsible for the general welfare of 

my soldiers over five different provinces in the central 
Iraqi area, ma'am. 

Q. Before you were at Fort Huachuca where were 

you assigned? 

A. Fort Gordon, ma'am. 

Q. And what did you do there? 

A. Part of the time I was there as a CID agent, 

part of time I was there as MI, ma'am, military 
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intelligence . 

Q. And so you were a different MOS for part of 

your time? 

A. Yes, ma'am. 

Q. What was that MOS? 

A. 98 Charlie, ma'am. 

Q. And what is that? 

A. Signals intelligence analyst. 

Q. Is that currently a 35 series? 

A. 35 November now, ma'am. 

Q. So what does a signals intelligence analyst 

do? 

A. Responsible for the collection, identification 

of intelligence, and then in the production of product to 
the command for action taken, if necessary. 

Q. How many years have you been in the Army? 

A. Been in the Army just over 13 years, ma'am. 

Q. And you say you've been a CID agent for six of 

those years? 

A. Yes, ma'am. 

Q. And what did you do for the other seven? 
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A. I was a 98 Charlie, ma'am. 

Q. What training did you receive to become a CID 

specialist? 

THE COURT: The 98 Charlie — 
THE WITNESS: Signals intelligence, ma'am. 
BY MS. OVERGAARD: 

Q. It was a 98 Charlie, now it's a — 

A. 35 November. Yes, ma'am. 

Q. So what training did you receive to become a 

CID special agent? 

A. We had 16 weeks at the CIDSAC course, CID 

special agent, at Fort Leavenworth, Missouri, ma'am. 

Q. And is that the CID (INAUDIBLE)? 

A. Yes, ma'am, it is. 

Q. What did you learn in that course, just in 

general? 

A. In general, the course went over law. It went 

over crime scene and the identification processing. It 
also went over about two or three days of digital media, 
a couple days on fraud examinations, and accumulated 
interviews and investigations, ma'am. 
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Q. You said crime scene processing and evidence 

collection? 

A. Yes, ma'am. 

Q. What other specialized training have you had 

as a CID agent? 

A. I've attended the hostage negotiators course. 

I ' ve attended the special agent laboratory technician 
training at Fort Gillem, U.S. Army Criminal Lab. I've 
attended the EMC Squared course . 

Q. And what's that? 

A. The evidence maintenance custodian's course. 

I've also attended multiple courses on post box crime 
scenes. And several different courses on interview 
interrogation , ma ' am . 

Q. Did any of the training focus on evidence 

collection? 

A. It did, ma'am. 

Q. What percentage of it? 

A. Of the training that we received during the 

CIDSAC course, there's a week dedicated to nothing but 
crime scenes, it's called crime scene hallway in which we 
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do nothing but process crime scenes to include the 
collection of evidence. 

Then with the post box courses, part of the 
training at the end is the data identification and 
recovery and collection of the evidence . 

And then the EMC Square course doesn ' t talk 
about the collection of the evidence, but I did a couple 
day ' s course pertaining to the proper maintenance of the 
evidence once it's brought into the evidence room, ma'am. 

Q. And how about specifically the collection of 

digital evidence? 

A. Digital evidence is covered, it's about a two 

or three day course that ' s taught within the CIDSAC 
course, ma'am. 

Q. And is there any other — well, is there any 

other unit level training for the collection of digital 
evidence? 

A. On occasion the digital forensic examiners 

which are at the battalion level will come into the field 
and conduct training with us, and they'll also send out 
bulletins as new techniques or new methods are learned to 
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keep us updated in the field, ma'am. 

Q. And what did you learn about the collection of 

digital evidence? 

A. The training basically comes down to 

photographing if the power is on, hit the shift key, 
photograph if anything 's on the screen, photograph the 
cables and connections leading into the computer, pull 
those, and then conduct a hard shutdown of the system, 
ma ' am. 

Q. Why do you do a hard shutdown? 

A. Because it has been identified that there is 

programs out there to where if you begin to do a soft 
shutdown of the system it will actually start to wipe 
media and programs off the system, ma'am. 

THE COURT: What is the difference between a 
hard shutdown and a soft shutdown? 

THE WITNESS: The soft shutdown, ma'am, is 
when you go into the system and tell it to turn itself 
off, like we do a restart on a computer on a nightly 
basis, ma'am. A hard shutdown is where you're actually 
pulling the power on it and it immediately shuts it down . 
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THE COURT: Thank you. 
BY MS. OVERGAARD: 

Q. You also mentioned processing a digital crime 

scene. When did you cover that? 

A. That is all part of the training during the 

two or three days at CIDSAC, ma'am. 

Q. So will you walk us through how you process 

the digital crime scene? 

A. First thing to do, it doesn't deviate any more 

than any other crime scene except the evidence that 
you ' re collecting and how you go about collecting it , but 
you start out with photographing the crime scene . After 
you photograph the crime scene you conduct a pen and ink 
sketch of the scene, and then you begin your search of 
the scene looking for evidence within the crime scene, 
ma 'am. 

As you come across digital media, it's going 
to be photographed in place, marked on the sketch on 
where it ' s being collected from and then collected, 
ma 'am. 

Q. Is there any special way to store that digital 
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evidence? 

A. It's recommended that it's placed inside a dry 

element to prevent dust and other elements getting to it, 
as well as water. So the best practice is to keep it dry 
and clean , ma ' am . 

Q. Do you have any degrees that are relevant to 

your job as a CID agent? 

A. I have a bachelor's in psychology and criminal 

justice, and I'm about one class away from my master's 
degree in criminal justice with an emphasis in law and 
forensic science, ma'am. 

Q. And how many cases have you conducted 

investigative activity as a CID agent? 

A. Investigative activity, I've probably been a 

part of approximately 250 cases, ma'am. 

Q. And how about as the primary, the lead agent? 

A. Lead agent or conducting significant 

investigative activity, approximately 150, ma'am. 

Q . How about how many computer crime cases have 

you worked as a CID agent? 

A . Approximately ten , ma ' am . 
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Q. And how did you first become involved with 

this particular case? 

A. While we were there at VBC, our commander 

received a request for an investigation, or an RFI from 
CID command. He brought us around the table, briefed us 
as far as what was contained within the RFI and we broke 
it down into a three man element that was going to go to 
VBC , ma ' am . 

Q . Okay . And do you remember when you received 

this information? 

A. The 27th of May, 2010, I believe, ma'am. 

Q. Why did your office get it? 

A. Because FOB Hammer was within our AO, ma'am. 

Q. And were you personally tasked? 

A . I was , ma ' am . 

Q. You were part of the three man team that you 

talked about? 

A. Yes, ma'am. 

Q . And what was your role to be on that three man 

team? 

A. I was being sent out there to conduct the 
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crime scene as well as the evidence collection while we 
were there, ma'am. 

Q. Why were you chosen? 

A. I was the senior enlisted. I had a lot more 

crime scene experience than a lot of the other agents in 
the office, and since I had already taken the soft course 
then I was chosen for that, ma'am. 

Q. Who else was assigned to that team? 

A. Agent Lisandre, Agent Toni Graham. There was 

a CI, counter intelligence agent that was assigned to the 
team, and myself, ma'am. 

Q. Does your background as a 35 series, did that 

have anything to do with you being assigned to the team? 

A. It was partially one of the reasons that I was 

sent out there was also to conduct the interview of PFC 
Manning initially, and that was one of the reasons that I 
was sent out there was that I might be able to relate to 
him. 

Q. Because you were an intel analyst? 

A. Correct, ma'am. 

Q. Who was in charge of that team? 
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A. That, would have been Agent. Toni Graham, ma'am. 

Q. And what were the first actions that your team 

took when getting assigned to this case? 

A. Once we were assigned to the case, Agent 

Graham pulled all the information needed in order to go 
in front of the magistrate to get a search and seizure 
authorization. I myself, outside of packing my own gear 
obviously, also began packing the material that we were 
going to need once we hit ground as far as the crime 
scene to include cameras, paper bags and other items, 
ma 'am. 

Q. When did you go, when did you leave for this 

assignment? 

A. We left on the 27th of May, 2010, ma'am. 

Q. And where were you going? 

A. From VBC to FOB Hammer, ma'am. 

Q. Where was that? 

A. Ma'am, I don't remember. 

Q . Okay . 

A. I know it was on the other side of the river 

out in the middle of nowhere . 
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Q. How did you get there? 

A. We took helo flights out there, ma'am. 

Q. Okay. And you mentioned you gathered supplies 

for the mission. What did you gather specifically? 

A. Cameras, paper bags. We gathered tape 

measures, paper, pen and our computers so that we'd be 
able to work once we hit ground, ma'am. 

Q. And you said Agent Graham, she went and got 

search authorizations? 

A. Yes, ma'am. 

Q. Do you know what you were authorized to search 

once you hit the ground? 

A. I knew we were authorized to search the SCIF 

that PFC Manning was assigned to as well as his CHU, 
ma 'am. 

Q. And when did you get to FOB Hammer? 

A. The evening of 27 May 2010, ma'am. 

Q. What did you do right when you arrived at FOB 

Hammer? 

A. The first thing we did was we debriefed part 

of PFC Manning's chain of command. 
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Q. Then what did you do after that? 

A. We dropped our load and our equipment inside 

the battalion S2 1 s office and we went into the SCIF and 
we started conducting canvass interviews . 

Q. Why did you go to the SCIF? 

A. Because we were told that the team that PFC 

Manning worked with or the shift that he worked with was 
currently in the SCIF working. 

Q. And who all on your investigative team went to 

the SCIF? 

A. It was myself and Agent Toni Graham, ma'am. 

Q. And you said you were doing canvass 

interviews? 

A. Yes, ma'am. 

Q. Who was doing those interviews? 

A. Myself and Toni Graham, ma'am. 

Q. Was there any time that you broke off from 

doing those interviews? 

A. After we completed the canvassing interviews, 

at that point we switched over and started conducting the 
crime scene exam of the SCIF, ma'am. 
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Q. How did you conduct the crime scene 

investigation of the SCIF? 

A. Due to the nature, we had them cover up some 

of the material that was on the wall that was secret in 
nature, and then after they semi sanitized the SCIF we 
had them leave out of the SCIF and at that point we 
started photographing, sketching and documenting the 
scene, ma'am. 

Q. When you say sanitize, what do you mean? 

A. There was some stuff up on the wall that was 

secret in nature, so we had them put up a, I believe it 
was a blanket or something over it . It was one or two 
charts that were on the wall that were secret in nature 
as well that we had them pull down off the wall and put 
them face down on the tables, ma'am. 

Q. Why did you do that? 

A. Because cameras in theater were a luxury and 

hard to come by, and we knew that had we taken pictures 
of that material up on the wall we would then have to 
secure that camera and keep it a secret and would not be 
able to use it again in theater, ma'am. 
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Q. 



You mentioned you took photographs and did a 



sketch . 



Who did that? 



A. 



I took the photographs and conducted a rough 



sketch of the scene, ma'am. 



Q. 



Would you recognize them again if you saw 



them? 



A. 



I would, ma'am. 



THE COURT: All right. Hold on just a 
moment. We need to adjust. Is it something you can do? 

We ' re going to stop now . We ' re having some 
slight technical difficulties so I'm going to ask if you 
could, you're just temporarily excused. We'll fix these 
technical difficulties and don't discuss your knowledge 
of the case with counsel or the accused or anyone. 



witness out. Is this something we need to take a recess 
for? 



ten minute recess . The court reporter has some audio 
problems and needs to get with a technician to fix those. 



THE WITNESS: Yes, ma'am. 



THE COURT : So we ' re going to send the 



All right . Why don ' t we go ahead and take a 
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As we all know, we take a verbatim record of trial of 
these proceedings and we want to make sure we get them. 
(BRIEF RECESS . ) 

THE COURT: Anything else we need to address 
before we recall the witness? 

MS. OVERGAARD: No, ma'am. 

MR . COOMBS : No , ma ' am . 

THE COURT: Call the witness. 

MS . OVERGAARD : United States calls Special 
Agent Thomas Smith . 

THE COURT : Just remind you that you 1 re still 
under oath, Agent Smith. 

THE WITNESS: Yes, ma'am. 
BY MS. OVERGAARD: 

Q. And before we stopped you said that, I asked 

you if you would recognize the photos you took of the 
SCIF if you saw them again? 
A. Yes, ma'am. 

Q. And would you? 

A. Yes, ma'am. 

Q. I'm introducing prosecution exhibit 19 for 
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identification . 

Ma'am, I'm handing the witness what's been 
produced and marked as prosecution exhibit 19 for 
identification . 

Do you recognize that, Agent Smith? 

A. Yes, ma'am, I do. 

Q. And can you tell us what it is? 

A. It ' s a sketch depicting the SCIF on FOB 

Hammer, ma'am. 

Q. How do you recognize that picture? 

A. I'm the one that took the picture, ma'am. 

Q. What viewpoint? 

A. It shows the SCIF, inside of the SCIF with the 

E and E to my back with a picture across the far side of 
the SCIF, ma'am. 

Q. Is that photo accurate? 

A. Yes, ma'am. 

Q. And when was it taken, do you recall? 

A. It would have been late in the evening of 27 

May 2010, ma'am. 

Q. And does it accurately depict the SCIF on 27 
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May 2010? 

A. Yes, ma'am. 

MS. OVERGAARD: Ma'am, I'd like to offer what 
has been previously marked as prosecution exhibit 19 into 
evidence as prosecution exhibit 19. 

THE COURT: Any objection? 

MR . COOMBS : No , ma ' am . 

THE COURT: May I see it, please? 

Prosecution exhibit 19 for identification is 

admitted. 

MS. OVERGAARD: May I publish it, ma'am? 
THE COURT: Certainly. 
BY MS. OVERGAARD: 

Q. What physical area of the SCIF did your team's 

investigation focus on? 

A. We focused on what's depicted in that picture, 

two SIPRNET computers that are along the back wall there. 
Q. And could you circle that on the screen? 

A. Yes, ma'am. 

That area along the back wall, ma'am. 
Q. And why did you focus on that area? 
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A. When we were doing the canvass interviews with 

the shift workers that he worked with, those two work 
stations were identified as the work stations that he 
primarily used, ma'am. 

Q. Before — what color did you use to circle 

that? 

A . Green , ma ' am . 

Q. And did you collect any evidence from that 

area? 

A. Yes, ma'am, I did. 

Q. And what specifically did you collect? 

A. I collected two SIPR computers from that area, 

ma 'am. 

Q. What was the classification of those two 

government computers? 

A. Secret, ma'am. 

Q. Did you collect anything else from the SCIF? 

A. Yes, ma'am. We collected a NIPR computer as 

well from the SCIF, ma'am. 

Q. Is that on this photograph? 

A. No, ma'am, it's not. 
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MS . OVERGAARD : Ma ' am, we 1 re printing the 
screen with the green circle on it and we ' 11 have it 
marked as prosecution exhibit 19 Alpha. 

THE COURT: All right. Any objection to that 

procedure? 

MR. HURLEY: No, ma'am. 
BY MS. OVERGAARD: 

Q. Now, I'm retrieving what has been previously 

marked for identification as prosecution exhibit 20? 

THE COURT: Prosecution exhibit 19 Alpha is 

admitted. 

MS. OVERGAARD: Yes, ma'am. Prosecution 
moves to admit prosecution exhibit 19 Alpha for 
identification as prosecution exhibit 19 Alpha. 

MR. HURLEY: No objection. 

MS. OVERGAARD: I've retrieved plaintiff's 
exhibit 20 for identification. 
BY MS. OVERGAARD: 

Q. Handing plaintiff's exhibit 20 for 

identification to the witness, ma'am. 

Do you recognize that photo? 
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A . I do , ma ' am . 

Q. And can you tell us what that photo is? 

A. It ' s a depiction of the inside of the SCIF 

with the secret room to my back, shot across the SCIF to 
the E and E of the room, ma'am. 

Q. And how do you recognize that photo? 

A. I took the photograph, ma'am. 

Q. And when did you take that photo? 

A. 27 May 2010, ma'am. 

Q. How accurate is that photo? 

A. It ' s an accurate depiction of the SCIF as we 

found it, ma'am. 

Q. On what day? 

A. 27 May 2010, ma'am. 

MS. OVERGAARD: And the United States offers 
what ' s been previously marked as prosecution exhibit 20 
for identification into evidence as prosecution exhibit 
20. 

MR. HURLEY: No objection. 
THE COURT: Prosecution exhibit 20 for 
identification is admitted as prosecution exhibit 20 . 
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MS. OVERGAARD: May I publish it? 
THE COURT: Yes, you may. 
BY MS. OVERGAARD: 

Q. Special Agent Smith, can you point out that 

NIPR computer for us in the photograph? 

A. Yes, ma'am. It's right here along this work 

station here. 



Q 
A 

Q 
A 

Q 

A 

Q 



And what color did you use to circle that? 
Yellow, ma'am. 

Who collected that NIPR computer? 
I did, ma'am. 

And who collected the SIPR computers? 
I did, ma'am. 

Did you collect all the evidence in the same 



way ! 



A. Yes, ma'am. 

MS. OVERGAARD: Now, I'm printing prosecution 
exhibit 20 with the yellow circle on it as prosecution 
exhibit 2 OA for identification and moving to admit it as 
prosecution exhibit 2 OA. 

THE COURT: Any objection? 
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MR. HURLEY: No, ma'am. 

THE COURT: All right. When you get 19A and 
2 OA printed, just hand them to me. 
BY MS. OVERGAARD: 

Q. Did you collect that NIPR and those two SIPR 

computers in the same way? 

A. I did, ma'am. 

Q. Can you tell us how you collected them? 

A. I went up to each system, photographed them in 

place . After photographing them in place I hit the shift 
key, took a picture of the monitor. After taking a 
picture of the monitor, I took pictures of the cables 
leading in and out of the computer and conduct a hard 
shutdown. I can't remember, it doesn't matter which I 
did, whether I pulled the plug (INAUDIBLE), but I 
conducted a hard shutdown of the computer, ma'am. 

Q. What did you do with the evidence after you 

conducted the hard shut down? 

A. After I conducted the hard shutdown of the 

computer, they were placed inside brown paper bags and 
placed into my backpack, ma'am. 
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Q. 



Is the evidence documented anywhere? 



A. 



Yes, ma'am. It was documented on a DA form 



4137. 



Q. 



What is that? 



A. 



It's the evidence property, evidence property 



custody, ma'am, or EPCD. 



Q. 



And what did you record on 4137? 



A. 



The 4137 has the organization that's 



collecting the evidence, who or where it was collected 
from, a description of the evidence, and also contains 
the chain of custody for that evidence once it ' s 
collected, ma'am. 



department of law enforcement daily officer who collect 
collects that information, he puts down where it was 
collected, from or who it was collected from, and each 
person that the evidence was handed to then signs the 
form. 

Q. And was that evidence collected in accordance 

with your regulations? 



Q. 



How is it used to track the chain of custody? 



A. 



It starts out with the first day low, our 
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A. Yes, ma'am, it was. 

Q. Did you insure that you didn't modify the data 

in any way? 

A. Yes, ma'am. 

Q. Did you investigate any other part of the 

SCIF? 

A. No, ma'am. We focused primarily on the 

general SCIF area . 

Q. And why was that? 

A. There was a, the second section of the SCIF 

area was a collection, PFC Manning did not have an 
immediate work station back there to work out of, and 
plus they were actively engaged in the mission at the 
time we were there . 



Q. And what's the classification of the SigAct 
itself? 

A. That's always top secret, ma'am. 

Q. Agent Smith, you also mentioned that you make 
a sketch of the area? 

A. Yes, ma'am. 

Q. Did you do that in this case? 
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A. Yes, ma'am. 

Q. How did you prepare that sketch? 

A. At the scene, just pen and ink sketch, just a 

rough sketch depicting what of the overall scene, and 
then afterwards go in and add the evidence and where it 
was being collected from, ma'am. 

Q . Retrieving what ' s been produced and marked as 

prosecution exhibit 1 for identification. Do you 
recognize that? 

A. Yes, ma'am. 

Q. Can you tell us what it is? 

A. It ' s a rough sketch depicting the SCIF. 

Q. And how do you recognize that picture, or that 

diagram? 

A. I'm the one that conducted the sketch, ma'am. 

Q. And how are you familiar with that building in 

particular? 

A. We were in this building, we were inside the 

SCIF specifically for the canvass interviews as well as 
the crime scene itself, ma'am. 

Q. How accurate is that sketch that you did? 
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A. It's an accurate depiction of the SCIF, not to 

scale . 

Q. And who put the labels on the diagram showing 

what each object represents? 
A. I did, ma'am. 

Q. When did you record those locations, those 

pieces, where those pieces of evidence were located? 

A. I would have placed them on the original pen 

and ink sketch as each piece of evidence was being 
collected, ma'am. 

Q. So you draw the picture first and then you 

label it as you're going through? 

A. Yes, ma'am. 

Q. And you said it was originally in a pen and 

ink. How did it get to be in that format? 

A. Once I got back to the CHU, after a little bit 

of sleep, once I got back to the CHU I woke up, I did 
transfer my notes from pen and ink on to a, I can't 
remember if I was using a Word or Outlook, but one of 
those two programs to generate this sketch, ma'am. 

Q. Is that an accurate copy of what you had in 
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your pen and ink sketch? 
A. It is, ma'am. 

MS. OVERGAARD: Ma'am, the United States 
offers what ' s been previously marked as prosecution 
exhibit 17 for identification as prosecution exhibit 17. 
MR. HURLEY: No objection. 17? 
MS. OVERGAARD: 17, yes. 
THE COURT: Prosecution exhibit 17 for 
identification is admitted. 

MS. OVERGAARD: May I publish that, ma'am? 
THE COURT: Yes. 
BY MS. OVERGAARD: 

Q. Can you orient us to this sketch? 

A. Yes. In the picture depicted the E and E is 

the entrance and exit of the facility which is in the 
bottom right-hand corner of the picture . 
Q. Okay. And that's the door? 

A. Yes, ma'am. 

Q. And where was the evidence that you collected? 

A. Looking in two different areas, the two 

separate computers were collected from Alpha and Bravo, 
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and then the NIPR computer was collected from Charlie, 
ma 'am. 

Q. And what did you do with this evidence after 

you collected it? 

A. After I collected it it was placed into a 

paper bag and placed into my book bag, ma'am. 

Q. And why did you have it in a backpack? 

A. In order to maintain the evidence for 

accountability , ma ' am . 

Q. Did you ever move it to a different container? 

A. Yes, ma'am. 

Q. And what was that container? 

A. Once we were there the unit provided us with a 

large foot locker and two 5200 series locks and we at 
that point started putting all the evidence we collected 
into that foot locker, ma'am. 

Q. And why did you use a foot locker there 

instead of an evidence room? 

A. FOB Hammer did not have a PMO section, so 

there was no evidence room on FOB Hammer , ma ' am . 

Q. Do you have any reason to believe that the 
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evidence suffered any sort of damage or contamination? 
A . No , ma ' am . 

Q. You also mentioned that you searched the 

accused CHU? 

A. Yes, ma'am. 

Q. And who else searched that CHU with you? 

A. It was myself and Agent Toni Graham, ma'am. 

Q. Can you tell us what a CHU is? 

A. Containerized housing unit, ma'am. 

Q. And what is that? 

A. Basically it's a container that has been 

broken down into two or three different housing areas for 
soldiers to live in, ma'am, while deployed. 

Q. How far apart was the CHU from the SCIF? 

A. A hundred, 200 yards, ma'am. 

Q. And how did you determine that you needed, or 

how did you determine what CHU was the accused's? 

A. The PFC Manning's command actually drove us, 

not drove, but walked us over there and showed us which 
CHU it was, ma'am. 

Q. How did you determine what items in there you 
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should search? 

A. We waited for PFC Manning's command to get his 

roommate, and once his roommate came in, we had his 
roommate step inside and show us which side of the room 
was his, which bunk was his, which wall locker was his 
and which stack of TA 50 was his, ma'am. 

Q. And what did you do once you first entered the 

CHU? 

A. Once he stepped out and I went in, at that 

point we started conducting the exam consisting of 
photographs, then we did a rough sketch of the overview 
of the room, and at that point we started conducting a 
search of the room, ma'am. 

Q. What did you photograph? 

A. Photographed the entire room as we found it. 

Q. Would you recognize those photographs if I 

showed them to you again? 

A. I would, ma'am. 

Q. I'm retrieving what's been marked as 

prosecution exhibit 16 for identification. 

18. Yes. Sorry. 18 for identification. 
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Handing that to the witness . 

Do you recognize that? 

A. Yes, ma'am, I do. 

Q. And can you tell us what it is? 

A. It ' s a photograph depicting the CHU belonging 

to PFC Manning and his roommate, ma'am. 

Q. How did you recognize it? 

A. I'm the one that took the photograph. 

Q. Can you tell us what viewpoint that shows? 

A. It ' s a photograph just as you enter the room 

with the E and E to my back, and it's a shot taken across 
the room to the far corner, ma'am. 

Q. Again, when you say E and E, that's the door? 

A. Yes, ma'am. 

Q. How accurate is that photograph? 

A. It's an accurate depiction of how we found the 

CHU that evening, ma'am. 

Q. And what was the date, do you remember? 

A. Actually at that point it had rolled over to 

28 May 2010, ma'am. 

Q. Does it accurately reflect the CHU as you 
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found it on 28 May 2010? 

A. Yes, ma'am, it does. 

MS. OVERGAARD: Your Honor, the United States 
offers what ' s previously been marked as prosecution 
exhibit 16 for identification into evidence as 
prosecution exhibit 16. 

THE COURT: May I see it, please? 

MR. HURLEY: No objection. 

THE COURT: Prosecution exhibit 16 for 
identification is admitted. Or 18. Sorry. 

MS. OVERGAARD: Sorry. 18. 

THE COURT : For the record, we ' re talking 
about prosecution exhibit 18, not prosecution exhibit 16. 
MS. OVERGAARD: Yes, ma'am. 
May I publish it, ma'am? 
THE COURT: Yes. 
BY MS. OVERGAARD: 

Q. How did you and Agent Graham examine the CHU? 

A. Agent Graham started with PFC Manning's wall 

locker which is on the opposite wall just out of view and 
worked towards the foot of the bed. I started at the 
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head of the bed and the night stand and worked towards 
the foot of the bed, ma'am. 

Q. What part of the CHU did the investigation 

focus on, did it focus on one side or the other? 

A. It focused on PFC Manning's personal 

belongings on the far side of the CHU, ma'am, or on the 
right-hand side of the CHU. 

Q. And what did you specifically or what did you 

find when you searched the CHU? 

A. While searching the CHU I found several 

writable CDs, a laptop computer, as well as a CD holder 
containing a writable CD disk, ma'am. 

Q. Could we talk about each one in turn? 

A. Yes, ma'am. 

Q. Could you tell us in this photograph where you 

found you say the laptop? 

A. Yes. The laptop is sitting on top of a 

portable computer desk. 

Q. Could you point that out for us? 

A. Yes, ma'am. 

It's here, ma'am. 
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Q. And you circled it in blue? 

A. Yes, ma'am. 

Q. What kind of laptop was that? 

A. It was an Apple laptop, ma'am. 

Q. And how did you know it belonged to the 

accused? 

A. First off, we asked his roommate which side of 

the room was his and what was his personal property. 
Also, the orientation of the computer was with the screen 
facing PFC Manning's bunk as well as the keyboard, ma'am. 

Q. Who collected this piece of evidence? 

A. I did, ma'am. 

Q. How did you collect it? 

A. Photographed it in place, I hit the shift key, 

photographed the scene, then conducted a hard shutdown on 
the computer . 

Q. So in accordance with your regulations? 

A. Yes, ma'am. 

Q. What happened with this evidence after you 

collected it? 

A. It was placed inside a brown paper bag, and by 
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this time the command had provided us with a large foot 
locker so it was put into the foot locker and locked. 

Q. And do you have any reason to believe that 

this evidence suffered any damage or contamination? 

A . No , ma ' am . 

Q. Let's move on to the CDs that you mentioned. 

Can you show us where those were in the CHU? 

A. Which CDs, ma'am, because they were found 

pretty much in two separate areas? 

Q. Let's start with the first area. 

A. Okay. This area here at the night stand is 

where we found a handful, five, ten maybe, writable CDs. 

Q. And that's the area circled in black? 

A. Yes, ma'am. 

Q. And how do you know they were writable CDs, 

what does that mean? 

A. Writable CDs, generic CDs that we purchase 

from the store for the purpose of the owner putting data 
on them. 

Q. And who collected those? 

A. I did, ma'am. 
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Q. And how did you collect those? 

A. They were collected, placed into a smaller 

brown paper bag and placed inside the trunk, ma'am. 
Q. In accordance with your regulations? 

A. Yes, ma'am. 

Q. And how about, you said there was another CD? 

Where is that one? 

A. That other CD was found here amongst these 

boxes, ma'am. 

Q. And that's circled in pink? 

A. Yes, ma'am. 

Q. What was that CD? 

A. It was a CD, it was a writable CD that had 

handwriting as well as a secret, a military secret 
sticker on it, and some label maker sticker on it, ma'am. 

Q. It had a label maker sticker? Do you remember 

what that sticker said? 

A. I believe it was 12 July 2007 engagement zone 

30 CZ or something to that effect, ma'am. 

Q. Would you remember that CD if you saw it 

again? 
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A. I would, ma'am. 

Q . Handing you what ' s been marked as prosecution 

exhibit 15 for identification. Handing the witness 
prosecution exhibit 15 for identification. Do you 
recognize that? 

A. Yes, ma'am. 

Q. Can you tell us what it is? 

A. This is the CD case that contained the 

writable CD. 

Q. And how do you know? 

A. Because I'm the one that collected it, ma'am. 

Q. Is there anything that stands out to you about 

it? 

A. Just the writing and all that was on it, 

Reuters, F O I A, R E Q or request. 

Q. And as best you can tell, has the evidence 

changed in any way since you collected it? 

A. Not that I can tell, ma'am. 

Q. And when did you collect it? 

A. I collected it the 28th of May, 2010, ma'am. 

MS. OVERGAARD: The United States offers 
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what ' s been previously marked for identification as 
prosecution exhibit 15 as prosecution exhibit 15. 

THE COURT: Any objection? 

MR. HURLEY: No objection, ma'am. 

May we have a moment? 

THE COURT : Yes . Just to make sure the 
record is clear, prosecution exhibit 15 for 
identification has one, two, three, four CDs in it. One 
of them is relevant? One of them you're offering or — 

MS. OVERGAARD: We're offering the whole 

thing . 

THE COURT: The whole thing. Okay. 
Prosecution exhibit 15 is admitted. 

MS . OVERGAARD : The government printed 
prosecution exhibit 18 with the markings on it and moves 
to admit it as prosecution exhibit 18 Alpha. 

MR. HURLEY: No objection, ma'am. 

MS. OVERGAARD: May I publish this, ma'am? 

THE COURT: Yes. 
BY MS. OVERGAARD: 

Q. Agent Smith, is this — how do you know that 
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this was a CD that you found? 

A. I recognize the container that it was in and, 

as I said previously, I recognize the actual markings 
that are on the CD in question. 

Q. Can you tell us what those specific markings 

were? 

A. The 12 July 07 CZ engagement zone 30 GC off 

the label printer, and then also the DOD secret sticker 
and the Reuters F O I A, R E Q, ma'am. 

Q. Is that an official DOD secret sticker, do you 

know? 

A. It is, ma'am. 

Q. How do you know that? 

A. My time from working on the MI side of the 

world, ma'am. 

Q. And did you collect this CD? 

A. I did, ma'am. 

Q. How did you collect it? 

A. I collected the entire case, placed it inside 

a brown paper bag, and then it went into the black trunk 
or the foot locker, it was locked up, ma'am. 
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Q. Did you collect anything else from the CHU? 

A. Yes, ma'am. I collected an external hard 

drive and a camera. 

Q. I'm going to retrieve prosecution exhibit 15 

and publish it. 

Do you remember where the external hard drive 

was found? 

A. Yes. The external hard drive was found inside 

a day sack belonging to PFC Manning. 

Q. Can you show us where that is on the photo? 

A. I can't make out specifically which one is the 

day sack, but it would have been amongst his TA 50 there 
inside the room at the foot of the bed now. 

Q. What you circled in pink? 

A. Yes, ma'am. 

Q. And you also said you found a camera? 

A. Yes, ma'am. 

Q. Where did you find a camera? 

A. The camera was found on top of the foot locker 

here , ma ' am . 

Q . And that ' s what you circled in red? 
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A 



Yes, ma'am. 



Q 



And who collected this evidence? 



A 



I did, ma'am. 



Q 



And why did — who found the evidence? 



A 



Agent Toni Graham, ma'am. 



Q 



And why did you collect it? 



A 



It ' s easier for accountability and also for 



documentation for one agent to collect all the evidence 
out of the crime scene instead of having two or three 
different people collecting one or two items, it's easier 
to have one person collect and process all of the 
evidence inside the crime scene, ma'am. 

Q. How did you collect this evidence? 

A. It was placed inside brown paper bags and then 

placed into the foot locker and locked, ma'am. 

Q. In accordance with your regulations? 

A. Yes, ma'am. 



to admit the photograph with the two circles on it, the 
pink and red, as prosecution exhibit 18 Charlie or Bravo, 
18 Bravo. 



MS . OVERGAARD : Ma ' am, the government moves 
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MR. HURLEY: We're on 18? This isn't 15? 

THE COURT: I believe that is a good 
clarification for the record. I believe you did call it 
prosecution exhibit 15 before. Just so the record is 
clear, we're talking about prosecution exhibit 18 and 
this is 18 Bravo. 

So you have no objection, right? 

MR. HURLEY: I do not. 

MS. OVERGAARD: Thank you, ma'am. 
BY MS. OVERGAARD: 

Q. And you mentioned before you sketched the area 

as well. How did you do that? 

A. I just conducted a pen and ink or a pen and 

paper sketch at the scene, ma'am. 

Q. Did you mark all the evidence that you 

recovered? 

A. Yes, ma'am. 

MR. HURLEY: Ma'am, we're not going to have 
an objection to the sketch (INAUDIBLE) . 

MS . OVERGAARD : United States moves to admit 
what's been marked as prosecution exhibit 16 for 
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identification as prosecution exhibit 16. 

THE COURT : All right . And you 1 ve got no 
objection. Prosecution exhibit 16 for identification is 
admitted. 

MS. OVERGAARD: May I publish this, ma'am? 

THE COURT: Yes. 
BY MS. OVERGAARD: 

Q. Agent Smith, who put the legend on the sketch? 

A. I did, ma'am. 

Q. And when did you do that? 

A. The next morning after waking up and getting 

oriented, ma ' am . 

Q. And can you orient us to this sketch? 

A. Yes. The E and E to the CHU, entrance and 

exit, is in the bottom right-hand corner of the picture, 
ma 'am. 

Q. And where is all the evidence that you 

collected, can you just point it out? 

A. Yes, ma'am. 

Right here in this area is where we collected 
various CDs, they were both on top of and inside the 
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night stand . 

Q. That's the red circle? 

A. Yes, ma'am. 

The green circle here is where we collected 
the laptop computer from. 

Q. And that's marked A and with a green circle? 

A. Yes, ma'am. 

F is the cardboard boxes where we collected 
the CD case from marked in yellow. 

G marked in — okay . G marked in blue is 
where the camera was collected off of. 

And then right here where it says various TA 
50 marked in pink was in amongst there, was his day pack 
where we collected the hard drive off of, ma'am. 

MS. OVERGAARD: Ma'am, the United States 
moves to admit the marked up version of prosecution 
exhibit 16 as prosecution exhibit 16 Alpha. 

MR. HURLEY: No objection, ma'am. 

THE COURT : All right . Prosecution exhibit 
16 Alpha is admitted. 
BY MS. OVERGAARD: 
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Q. What did you do with all the evidence? 

A. The evidence was placed into brown paper bags, 

placed into the foot locker and locked, ma'am. 

Q. And did you search any other place? Did you 

process any other crime scenes when you were at FOB 
Hammer? 

A. No, ma'am, I did not. 

Q. And did anyone else on your team? 

A. Agent Toni Graham did the supply room and 

collected some evidence from there, ma'am. 

Q. And what were you doing while Agent Graham was 

searching the supply room? 

A. I was guarding the evidence, I was doing 

administrative stuff, I was preparing the sketches that 
you saw. I was writing up the crime scene exam from the 
night prior, ma'am. 

Q. Did Agent Graham bring you any evidence that 

she collected from the supply room? 

A. Yes, ma'am, she did. 

Q. Do you remember what she brought you? 

A. She brought me one laptop computer and two 
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external hard drives . 

Q. What were those external hard drives? 

A. One NIPR and one SIPR, if I'm not mistaken. 

Q. Were they government hard drives? 

A. Yes, ma'am, they were. 

Q. And what did you do when Agent Graham handed 

you that evidence? 

A. I typed up the 4187 and then those items, by 

this time I had run out of brown paper bags, by this 
time, so I typed up the EPCD and gave it to her to take 
it back for signature and the actual evidence itself was 
placed into the foot locker and locked, ma'am. 

Q. And how do you know? 

A. Because I'm the one that locked it up in 

security , ma ' am . 

Q. Were all the pieces of evidence that your team 

collected at FOB Hammer locked into that foot locker? 

A. Yes, ma'am. 

Q. And who guarded that foot locker? 

A. I guarded it the majority of the time, ma'am, 

except to go and eat one meal and showers . The rest of 
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the time when I was not guarding it it was under armed 
guard by either the MI soldier that was present or by 
Agent Toni Graham, ma'am. 

Q. So was it guarded the whole time? 

A. Yes, ma'am. 

Was it ever left unattended? 
No , ma ' am . 

And who maintained the keys to that foot 



Q 
A 

Q 

locker? 
A 
Q 



I did, ma'am. 

And after other people guarded the foot 
locker, did you insure the sanctity of the evidence in 
any other way? 

A. I did, ma'am. Upon returning to the CHU and 

taking over watch of the evidence I conducted a hundred 
percent inventory of the evidence . 

Q. What happened to the foot locker when you 

wrapped up the investigation at FOB Hammer? 

A. It was placed on to the chopper and was flown 

back to VBC , ma ' am . 

Q. It was with you the whole time? 
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A. Yes, ma'am. 

Q. What did you do with it when you got to Camp 

Liberty? 

A. Camp Liberty, we transferred it to FOB Liberty 

where the actual CID office was, and the evidence was 
transported there into the security safe inside the 
office, ma'am. 

Q. And what kind of safe is that? 

A. It ' s a large metal wall locker that has a 

metal hasp and a 5200 series lock on it, ma'am. 

Q. And who took possession of the evidence — did 

it leave the locker at all? 

A. It did. After we got back and got settled I 

assigned all the evidence over to Agent Robertson, ma'am. 

Q. Who is Agent Robertson? 

A. He's an agent with the CCIU, computer crimes 

investigative unit for CID out of Germany, ma'am. 

Q. Was all of the evidence that you collected 

from FOB Hammer turned over to Agent Robertson? 

A. It was, ma'am. 

Q. And you said you filled out the 4137? 
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A. Yes, ma'am. 

Q. Do you know why Agent Robertson took 

possession? 

A. Agent Robertson was going to begin a triage 

look at the evidence to see what if anything he could 
find on the computers . 

Q. And what role did you have in that process? 

A. Outside of talking to him, you know, every now 

and again to find out if he found anything, none. 

Q. And how do you know the evidence went to him? 

A. Because I did a hundred percent turnover of 

the evidence to him. 

Q. When was that? 

A. 30 May 2010, ma'am. 

Q. And before you turned that evidence over to 

him, do you have any reason to believe that it suffered 
any damage or contamination? 
A . No , ma ' am . 

MS. OVERGAARD: Thank you. 
THE COURT: Cross examination. 
MR. HURLEY: Yes, ma'am. 
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CROSS EXAMINATION 

BY MR. HURLEY: 

Q. Special Agent Smith. 

A. Yes, sir. 

Q. You participated in drafting the investigation 

plan for this case? 

A. The investigative plan? 

Q. Yes. Well, at some point it was determined 

that canvass interviews would be done? 
A. Yes, sir. 

Q. And then a crime scene investigation would 

occur? 

A. Right. And that's standard, so — 

Q . Right . So there wasn ' t much in terms of a 

formal planning process to talk about what you would do 
at FOB Hammer once you arrived? 

A. There was some discussion, but it was pretty 

much segmented and everyone had their goal and their task 
when they hit the ground, sir . 

Q. Right. And part of your goals and task was to 

go to the TOC and to conduct canvass interviews? 
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A. Yes, sir. 

Q. And you did that, except for briefing the 

command, you did that immediately upon your arrival? 
A. Yes, sir. 

Q. And you talked to everyone you could find in 

the S2 section? 

A. Everyone that was identified as working on his 

shift inside the SCIF, sir, yes. 

Q. And that's both for the S2 section and the S4 

section? 

A. I don't know who was — that night when I did 

the canvass interviews, sir, I don't remember talking to 
anyone from the S4 . All the people I spoke to were from 
the S2 side of the SCIF, sir. 

Q. Let's just talk about canvass interviews 

generally. You have a set series of questions that you 
want to ask in a canvass interview? 

A. Yes, sir. 

Q. Now, that may not be all the questions you 

ask, but the set ones that you ask are pretty standard? 
A. Well, they're standard in reference to that 
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investigation, but I can't ask the same questions for a 



computer crime as I would do for a sexual assault, sir. 

Q . Right . Once you agree upon the questions in a 

particular investigation, that's a series of questions? 

A. Yes, sir. 

Q. And the idea of a canvass interview is to 

identify those people who you want to formally interview? 
A. Yes, sir. 

Q. So you're looking to get more information? 

A. Yes, sir. 

Q. And you mentioned now when you're doing, 

that's any interview of any duration, you're going to 
identify yourself? 

A. Yes, sir. 

Q. As a member of the criminal investigation 

command? 

A. Yes, sir. 

Q. And you're going to identify generally what 

you want to talk about? 
A. Yes, sir. 

Q. In this case you, a lot of the questions, your 
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set of questions identified PFC Manning? 
A. Yes, sir. 

Q. And in this canvass interview, if the witness 

has more information, you're not going to stop him, are 
you? 

A. No, sir. 

Q. And if they had something to say, you would 

further develop that information? 
A. Yes, sir. 

Q. Do you recall specifically identifying any 

individuals that you canvassed for additional interviews? 
A. No, sir. 

Q. And as you're interviewing these witnesses, if 

someone would have told you more about PFC Manning, a lot 
about PFC Manning, you would have identified that 
individual for a follow-up interview? 

A. Yes, sir. 

Q. And that interview would be included in your 

investigative report? 
A. Yes, sir. 

Q. And in all likelihood you'd write an agent 
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investigative report, an AIR on that interview as well? 

A. When we do an AIR entry, but the AIR itself is 

a living document covering a large aspect of it . There 
would be an AIR entry pertaining to that interview, but 
the AIR specific to that interview would not be done, 
sir . 

MR. HURLEY: Thank you, Special Agent Smith. 
I have no further questions . 

THE COURT: Any redirect? 

MS . OVERGAARD : One moment , ma ' am . 

No , ma ' am . Thank you . 

THE COURT: All right. Special Agent Smith, 
I just have a couple questions following up the cross 
examination . 

If I understood, did I understand your 
testimony to be that you do canvass interviews with 
people to determine whether they know something more that 
maybe you need to develop further questions to flush out 
that information from those people? 

THE WITNESS: Right, ma'am. We usually go 
into it and usually you start out with five or six 
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generic questions that you're going to ask everybody, 
okay. And then if someone starts to give information 
that's pertinent to that, at that point you start asking 
follow-up questions pertaining to, pertaining to, 
pertaining to it. And then at that point, hey, you know, 
once you realize that that individual does have 
significant information and all pertaining to the 
investigation, at that point you can either pull them 
aside and actually do a full interview of them, or you 
can schedule an appointment for them to come in and 
provide a statement, ma'am. 

THE COURT: And the people that you 
interviewed, I believe you said it was on the 28th of 
May, 27th of May? 

THE WITNESS: 27th. 

THE COURT: Did you pull aside any of those 
people for more significant interviews or were they all 
at the canvass level? 

THE WITNESS : They were all at the canvass 
level because no one actually saw any misdoings on the 
computers, ma'am, and that's what the canvass interview 
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is meant to do is to try and find an individual that 
might have saw something, okay. 

You know, a lot of his co-workers and all, 
they saw the fight and all that took place in the SCIF. 

THE COURT: Okay. I'm good. 

Counsel, any follow-up from my questions? 

MR. HURLEY: None from the defense, ma'am. 

MS . OVERGAARD : Just one , ma ' am . 
REDIRECT EXAMINATION 

BY MS. OVERGAARD: 

Q. Does that mean that no statements were taken 

from other people or just that you didn't take any? 

A. I took one statement the time that I was at 

FOB Hammer from Specialist or Private Satler or something 
to that effect, and I don't remember if there was any 
other statements taken while we were out there or not, 
ma ' am. 

MS . OVERGAARD : Okay . Thank you . 

THE COURT: All right. Anything from the 

defense? 

MR. HURLEY: No, ma'am. 
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THE COURT : All right . Temporary or 
permanent excusal? 

MS. OVERGAARD: Temporary, ma'am. 

THE COURT: All right. Now, with the 
temporary excusal — well, we can talk about that as a 
recess. Are we keeping people in the building or does it 
vary witness by witness, what do you want to do? 

MR. FEIN: May it vary witness by witness? 
If there's an authentication issue, we'd recall for 
instance, Mr. Smith, but other witnesses are being called 
back knowing we're actually calling them back. So it 
will vary by witness . 

THE COURT: So when I temporarily excuse 
witnesses they know where to go . 

MR. FEIN: They absolutely know where to go. 

THE COURT: All right. You're excused. 
While excused, please don't discuss anything with anyone 
other than counsel or the accused while the trial is 
going on. 

THE WITNESS: Thank you, ma'am. 

MR. FEIN: United States requests a ten 
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minute recess, comfort break. 

THE COURT: Court is in recess until 1530. 
(BRIEF RECESS . ) 

THE COURT: Government, are you ready to call 
your next witness? 

MS. OVERGAARD: Yes, ma'am. The United 
States calls Special Agent Toni Graham. 
Whereupon : 

TONI GRAHAM, 

called as a witness, having been first duly sworn 
according to law, testified as follows: 

DIRECT EXAMINATION 

BY MS. OVERGAARD: 

Q. And you are Special Agent Toni Graham? 



A 

Q 
A 

Q 

Graham? 
A 



Yes, ma'am. 

And what is your rank? 
CID 2. 

Where are you currently assigned, Agent 
To the Hawaii CID office in Schofield 



Barracks . 
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Q. And where is that? 

A. Schofield Barracks, Wahiawa, Hawaii. 

Q. What's your position? 

A. I'm the general crimes team chief. 

Q. And what does the general crimes team chief 

do? 

A. We supervise investigations on general crimes. 

Q. And what are general crimes? 

A. General crimes are all investigations with the 
exception of sex offenses and drug offenses. 

Q. What was your previous assignment? 

A. General crimes team chief at the Fort Knox CID 
office . 

Q. And when were you at Fort Knox? 

A. From 2009 to 2011. 

Q. And before you were at Fort Knox where were 
you assigned? 

A. Fort Polk. 

Q. And when was that? 

A. 2005 to 2009. 

Q. So how long have you been a CID agent? 
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A. For eight years. 

Q. And how long have you been a warrant officer? 

A. For four years. 

Q. What did you do before you became a CID agent? 

A. I was military police. 

Q. And what did you do as a military police 

officer? 

A. As military police I worked patrol on the 

road, I worked as a desk sergeant at the PMO, and I also 
worked physical security at SCIFs . 

Q. And could you explain those a little bit more? 

What's patrol mean as an MP? 

A. Patrol is like the regular what you think a 

military cop, riding a patrol car, responding to 
domestics . 

Q. How about a desk sergeant, what is that? 

A. Desk sergeant is like a supervisor for the 

shift, you sit on the desk and receive calls from 9-1-1 
complaints or anyone that has any kind of issue, and then 
you have the patrols respond to the scenes . 

Q. So how about you said physical security, what 
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is that? 

A. Yes, ma'am. I worked physical security at a 

SCIF in Fort Belvoir. Basically you just conduct 
searches on people entering and exiting the SCIF and man 
the location, make sure it's secured. 

Q. Do you go into the SCIF at all? 

A. Yes, ma'am. 

Q. How often do you go into the SCIF? 

A. Typically it's three times a day for patrols 

or for security checks to make sure all the doors are 
locked. 

Q. So how long have you been in law enforcement 

for the Army? 

A. Thirteen years. 

Q. And how long have you been in the Army? 

A. Thirteen years. 

Q. What training did you receive to become an MP? 

A. As an MP we attend an OSUT training which is 

just the MP. 

Q. What is OSUT training? 

A. One station unit training. 
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Q . And what training did you receive while you 

were an MP, any advanced training? 

A. I did. I attended the military police 

investigations course . 

Q. What do you learn there? 

A. How to become a military police investigator. 

Q. Does it involve any crime scene evaluation? 

A. Yes, ma'am. It's crime scenes, interviews, 

interrogations, collection of evidence, quick law 
background, constitutional stuff, things like that, 
amendment rights, and weapons training. 

Q. Have you had any evidence collection training? 

A. Yes, ma'am. 

Q. And where was that? 

A. That was at Fort Leavenworth, Missouri. 

Q. What kind of training was it, or what school 

was it? 

A. The military police investigations course. 

Q. What training have you received to become a 

CID special agent? 

A. Special agent course, basic fundamentals and 
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what to expect from you as a special agent . 



Q. Is that your AIT? 

A. Yes, ma'am. 

Q. How about since you've been a CID special 
agent, have you had any additional training? 

A. Yes, ma'am, I have. 

Q. What have you done? 

A. I've attended the detective service course, 



the advanced crime scene course, the special laboratory 
training course, with advanced management, hostage 
investigations, special victim's unit course, post box 
investigation . 



Q. So a lot of training? 

A. Yes, ma'am. 

Q. Did any of that training focus on crime scene 
training? 

A. Yes, ma'am. 

Q. And what training focused on that? 

A. The advanced crime scene examination course 



focuses on that as well as special agent laboratory 
course, laboratory training course. 
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Q. What does it mean to evaluate a crime scene? 

A. Well, to evaluate a crime scene you respond to 

a location where an alleged crime occurred and you 
inspect the location for potential evidence, take 
photographs, you sketch the area. 

Q. Did any of your training focus on evidence 

collection as well? 

A. Yes, ma'am. 

Q. And digital evidence collection? 

A. Yes, ma'am. 

Q. And what training focused on the collection of 

digital evidence? 

A. Digital evidence also covered advanced crime 

scenes . It ' s also mentioned in the special agent 
laboratory course. We also cover it in several of our 
Army courses like B knock and advanced officer course and 
advanced course. We also receive digital evidence 
training either I would say every other month from our 
local digital forensic examiner. 

Q. What's the role of the local digital forensic 

examiner? 
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A. They conduct forensic examinations on the 

evidence we collect . 

Q. Are they CID agents as well? 

A. Yes, ma'am. 

Q. So how do you collect digital evidence, what 

have you learned? 

A. Basically you remove the power source to the 

item and collect the item, take it into your physical — 

Q . I'm sorry . 

A. All right. 

Q. What did you learn about the preservation of 

digital evidence? 

A. So when an item is on say a monitor or a 

computer is running, what we do when we collect, before 
we collect it, we determine whether the item is 
processing something, defragmenting or running some kind 
of deletion program. If that is the case, then we remove 
the power cord or the battery from the back of the device 
immediately. If it's not doing that, then we take a 
photograph of the screen and then remove the power cord 
from the back or whatever power device. 
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Q. And then what do you do with the digital 

evidence when you collect it, what process do you follow? 

A. The mark it with the time and initial of the 

time we collect it and we mark it on an evidence property 
custody document . 

Q . And what ' s the evidence property custody 

document? 

A. It is a document where we collect all items 

that we are determining if it's evidence or not. 

Q. Just generally what does it contain, what 

information does it contain? 

A. The top section of the document is 

administrative data, who you're collecting it from, where 
you are when you're collecting it. The center portion is 
the description, quantity, how many items there are, what 
is the item. You include serial numbers, any kind of 
damage or anything that's unique to that item. You also 
in there enter how you collected it, if you just 
physically marked it with time, date and initials or 
place it into a container with time, date and initials. 

And then at the bottom portion of the 
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document is the chain of custody . 

Q . How does someone know when they ' re getting 

evidence that they ' re getting what they think they ' re 
getting? 

A. You can compare the actual piece of evidence 

to the description of the evidence on the evidence 
voucher . 

Q. Does that happen every time? 

A. Yes, ma'am. Unless it's sealed. 

Q. And how do you know it happens every time? 

A. It's part of the process and it's regulation. 

Q. How many cases have you tried, or how many 

cases have you worked as a CID agent? 

A. Roughly, maybe a hundred a year. 

Q. So about, you said eight years you've been a 

CID agent, so about 800? 

A. Yes, ma'am. 

Q. And about how many computer crimes have you 

investigated? 

A. At least 15 a year, and every year that's 

progressively more . 
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Q. And was there — have you deployed to Iraq? 

A. Yes, ma'am. 

Q. Do you remember when that was? 

A. Yes. 

Q. Can you tell us when it was? 

A. From April 2010 through March of 2011. 

Q. So that was out of Fort Knox? 

A. Yes, ma'am. 

Q . Where were you stationed when you deployed? 

A. I was stationed, I was assigned to the Baghdad 

CID office at Camp Liberty. 

Q. What was your position at Camp Liberty? 

A. I was a senior case agent and the assistant 

special agent in charge. 

Q. What did you do as the senior case agent and 

the assistant special agent in charge? 

A. As the assistant special agent in charge, 

anytime the SAC is out of the office you step in and 
assume responsibility. As a senior case agent you work 
cases just like anyone else. 

Q. Are you the most senior case agent in the 
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office? 

A. Yes, ma'am. With the exception of the SAC. 

Q. How did you first become involved in this 

particular case? 

A. I was notified by the SAC on the morning of 

May 2010 to report to our battalion regarding an 
allegation . 

Q. And what did you learn? 

A. There I learned we received information, or 

headquarters received information from the FBI that was 
from a non-government agency wherein their confidential 
informant had communication with PFC Manning wherein he 
had related that he had obtained secret documents for 
personal use . 

Q. And did you receive any specific evidence? 

A. Yes. They were chat logs. 

Q. And did you look at those chat logs? 

A. Yes, ma'am. 

Q. Who was on those chat logs? 

MR. HURLEY: Objection (INAUDIBLE) . 
THE COURT: Hold on. Sustained. 
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BY MS. OVERGAARD: 

Q. So you said you found chat logs. What did 

your office do once you received that information? 

A. Upon receiving the chat logs we were able to 

corroborate as much information in there as we could as 
far as the details provided by PFC Manning to the source. 

Q. Did you corroborate that information? 

A. Yes, ma'am, there were several pieces that we 

were able to corroborate . 

Q. What did you corroborate? 

A. Basically most of his military information 

that he had mentioned in the chat logs . Some of his 
personal information that we were able to obtain from 
social network sites that he had posted in both the 
network site and the chat logs . 

Q. What did you do after reviewing this 

information? 

A. I drafted an affidavit and went to the 

military magistrate for a search authorization. 

Q. Did you get the authorization? 

A. Yes, ma'am, I did. 
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Q. And do you remember what you got the 

authorization for? 

A. I requested to seize his assigned work 

terminals and all of his personal computers or storage 
devices, media storage devices that were at FOB Hammer. 

Q. And what did you do after you got the 

authorizations? 

A. We gathered a team and we proceeded to FOB 

Hammer that night . 

Q. What was the first thing that you did when you 

got to FOB Hammer? 

A. First thing. We met with Staff Sergeant 

Bigelow and Captain Freiberg who was the HOC commander 
and they escorted us to a location where we could 
designate our own, and then we briefed the chain of 
command on the FOB. 

Q. Who traveled with you? 

A. It was myself, Special Agent Tom Smith, 

Special Agent Jean Lisandre and Counter Intelligence 
Special Agent Nathan Langley. 

Q. What was your role in that team? 
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A. I was the team chief for the mission. 

Q. What does that mean? 

A. Supervisor. 

Q. So you said you briefed the chain of command. 

Why did you brief the chain of command? 

A. Upon arrival we briefed the chain of command 

basically to let them know what the allegation was, that 
we had obtained a search authorization and we would be 
collecting certain items, and just to let them know that 
we would be affecting their normal operations for the 
next couple days . 

Q. Do you remember what day that was? 

A. That was on the evening of 27 May 2010. 

Q. Where did you go first after you briefed the 

chain of command, or where did you go after you 
designated your area you said? 

A. After we designated our area as the chain of 

command . 

Q. And after that where did you go? 

A. From there we went to the SCIF there on the 

TOC. 
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Q. What did you do at the SCIF? 

A. There we began canvass interviews. 

Q. And why did you start at the SCIF? 

A. Because that is the location that was most 

logical being that that 1 s where PFC Manning was working 
at the time of the chat logs or at the time. 

Q. How did you know he was working there? 

A. Through his chain of command. 

Q. And who, just generally, who did you interview 

at the S2? 

A. We conducted canvass interviews of the S2 

section . 

Q. And who in particular? 

A. Basically all the people that were on mid 

shift there at the time we arrived, and then we slowly 
worked through the rest of the S2 section, the day shift 
and the rest of the individuals . 

Also, we briefed the S4 section or canvassed. 

Q. The S4 section? 

A. Yes, ma'am. 

Q. Okay. What was the rest of your team doing? 
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A. Agent. Smith was also conducting canvass 

interviews with me . Agent Langley was as well until he 
went with Agent Lisandre . 

Q. And was there a time that you started 

processing the scene? 

A. Yes, ma'am. During the canvass interview 

Agent Smith broke off from the canvasses and began 
processing the SCIF of the crime scene. 

Q . And do you know what he did to examine the 

crime scene? 

A. Well, because it was a SCIF there was top 

secret information on the wall so we had to do a little 
sanitizing, covering up the photos on the wall and 
collecting evidence. 



Q. 


Did he collect any evidence? 


A. 


Yes, he did. 


Q. 


And do you know what he collected? 


A. 


Yes, ma'am. 


Q. 


How do you know? 


A. 


Because I observed him doing that . 


Q. 


What did he collect? 
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A. He collected two SIPR terminals and one NIPR 

terminal . 

Q. Do you remember where he collected those items 

from? 

A. Yes, ma'am. 

MS . OVERGAARD : Ma ' am, permission to publish 
prosecution exhibit 17. 

THE COURT: All right. 
BY MS. OVERGAARD: 

Q. Are you familiar with this sketch? 

A. Yes, ma'am, I am. 

Q. And how are you familiar with this sketch? 

A. This is the rough sketch of the SCIF FOB 

Hammer, and I also verified this piece of paper. 

Q. What does it mean to verify a sketch? 

A. It's accurate to the best of its ability. 

Q. Does this sketch accurately depict what was 

collected from the SCIF on 27 May? 

A. Yes, ma'am. 

Q. And to your knowledge, did your team's 

collection of this evidence follow your regulations? 
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A. Yes, ma'am. 

Q. And do you have any reason to believe that 

evidence suffered any damage or contamination? 
A . No , ma ' am . 

Q. Do you know where the evidence was stored? 

MR. HURLEY: We would object as to the 
cumulative nature of this evidence. We've heard this. 

THE COURT: Why are we going through this 
again? Is there a reason? 

MS . OVERGAARD : We ' re quickly going over some 
of the first (INAUDIBLE) supervisor capacity, and 
(INAUDIBLE) . 

THE COURT: Defense, do you have an objection 
that there ' s some taint in the evidence when the CID 
agent had it? 

MR. HURLEY: No, ma'am. 
THE COURT: Move on. 

MS . OVERGAARD : Can I have one moment , 
please , ma ' am? 

THE COURT: Yes. 
BY MS. OVERGAARD: 
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Q. Agent Smith, you said that — I'm sorry. 

Agent Graham, you said that you also talked to S4 
personnel. What is S4? 

A. The supply section, ma'am. 

Q. And did you search the supply room? 

A. I looked in the supply room, yes, ma'am. 

Q. Why was that? 

A. It was identified that there was additional 

pieces of possible evidence in the supply room. 
Q. How did you know that? 

A. When canvass interviewing Staff Sergeant 

Bigelow who was the supply room NCOIC, he had informed me 
that Manning was transferred over there and there were 
two terminals in that room that he was using in during a 
probably two week period of time . 

Q. And did you collect any evidence from the 

supply room? 

A. Yes, ma'am. 

Q. And what did you collect? 

A. I collected the hard drive from the SIPR 

computer in the supply room and a hard drive from the 
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NIPR computer in the supply room. 

Q. And what did you do with that evidence when 

you collected it? 

A. Collected it on an evidence property document 

and placed them into an envelope . 

Q. And where did you take that evidence? 

A. To Agent Smith, transferred control over to 

him, and he placed them into the foot locker . 

Q. And who was responsible for the foot locker? 

A . Agent Smith . 

Q. Did everything you collect go into that foot 

locker? 

A. Yes, ma'am. 

MS . OVERGAARD : Nothing further , ma'am. 
THE COURT: Cross. 

CROSS EXAMINATION 

BY MR. HURLEY: 

Q. Special Agent Graham, let's first talk about 

your interactions with PFC Manning. You saw PFC Manning 
on FOB Hammer? 

A. Yes, sir. 
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Q. You saw him several times? 

A. At least two that I can recall. 

Q. Every time you saw him he was under escort? 

A. Technically, yes, yes, sir. 

Q. Thank you. 

Let ' s talk about the canvass interviews that 
you conducted. Those canvass interviews you said you 
talked to people from the S2 section? 

A. Yes, sir. 

Q. And the S4 section? 

A. Yes, sir. 

Q. And in interviewing generally, in all of your 

experience and training, you will typically start an 
interview of whatever length by identifying yourself? 

A. Yes, sir. 

Q. And identifying the topic generally that 

you're talking to this person about? 
A. Depends, sir. 

Q. Well, in this particular case you had 

identified about seven canvassing questions that you were 
going to use? 
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A. Right, to start off, yes, sir. 

Q. And those canvassing questions all mentioned 

PFC Manning by name, or a few of them certainly did? 

A. I'm sure a majority of them did. 

Q. Now, you used a canvass interview to identify 

witnesses that you want to do more detailed interviews 
with? 

A. Yes, sir. 

Q. And the investigator that's conducting this is 

actually actively looking for information while doing it, 
or let's not speak in the third person. When you do 
these canvass interviews, you're actively looking for 
more information? 



A. Yes, sir. 

Q. And you're not going to stop anyone from 

talking to you, are you? 
A. No, sir. 

Q. If they're telling you relevant information, 

you ' re going to take it all down and even ask follow— up 
questions? 

A. Absolutely, sir, yes. 
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Q. So those questions, those seven questions that 

we talked about, those weren't all the questions you 
asked? 

A. Not on every individual, but that was the 

probing questions that we began with every individual . 

Q. Right. And you can recall identifying certain 

witnesses for follow-up? 

A. Yes, sir. 

Q. For instance, you did a follow— up interview 

with Captain Lemm who was the OSC of the brigade S2 
section? 

A. I don't know, sir. We didn't obtain a sworn 

statement from Captain Lemm. 

Q. What about Captain Freiberg, do you recall 

doing a more in-detail interview with him? 

A. Yes, sir, but not because of the canvass 

interviews . 

Q. And what about Sergeant Bigelow, was that 

because of the canvass interviews or did you — first 
off, did you do a more detailed interview with Sergeant 
Bigelow? 
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A. Yes, sir, we did. 

Q. Was that because of the canvass interviews? 

A. No, sir. As part of the canvasses we did 

interview him, but we had identified him upon our 
immediate arrival that he was going to be someone we 
probably interview . 

Q. So if a witness had told you they knew why PFC 

Manning disclosed information, you would have followed up 
on that? 

A. Yes, sir. 

Q. And as the senior person on the ground, you 

would expect another person conducting a canvass 
interview, you would expect that person to relate that 
information to you? 

A. Yes, sir. 

Q . Let 1 s talk about FOB Hammer . You were there 

for approximately five days, is that right? 

A. I can't recall, but it was a couple of days, 

yes, sir. 

Q. About a week maybe? 

A . Maybe . 
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Q. And this is in late May and early June of 



2010? 



A. Yes, sir. 

Q. And do you recall any enemy activity on the 



FOB? 



A. Not at the time we were there, no, sir. 

Q. So no mortars — 

A. No, sir. 

Q. — that you can recall, or small arms fire? 

A. No, sir. 

MR. HURLEY: Thanks, Special Agent Graham. 

THE COURT: Redirect. 

MS. OVERGAARD: No, ma'am. 

THE COURT : All right . Temporary or 
permanent excusal? 

MS. OVERGAARD: Temporary, ma'am. 

THE COURT: Hold on. Government, do you want 

to confer? 

MS . OVERGAARD : One moment , please , ma ' am . 
(DISCUSSION OFF THE RECORD.) 
MS . OVERGAARD : No , ma ' am . Temporary 
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excusal . 

THE COURT : All right . You are temporarily 
excused. Please don't discuss your testimony or 
knowledge of the case with anyone other than counsel or 
the accused while the trial is going on. 

THE WITNESS: Yes, ma'am. 

THE COURT: Thank you. 

Government ready to call your next witness? 

MS. OVERGAARD: Yes, ma'am. The United 
States calls specialist Eric Baker. 
Whereupon : 

ERIC BAKER, 

called as a witness, having been first duly sworn 
according to law, testified as follows: 

DIRECT EXAMINATION 

BY MS. OVERGAARD: 

Q. And you are Specialist Eric Baker? 

A. Yes, ma'am, I am. 

Q. What's your current unit, Specialist Baker? 

A. My current unit is 491 in Fort Hood, Texas. 

Q. What's your current position there? 
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A. 
Q. 

officer? 
A. 

Q. 
A. 

Q. 



Military police officer. 

How long have you been a military police 
For five years. 

And how long have you been in the Army? 
For five years, ma'am. 

Where were you assigned before you were at 



Fort Hood? 

A. I was stationed at Fort Drum, New York, in the 

Second Brigade, Tenth Mountain. 

Q. And when were you at Fort Drum? 

A. From January — no. From June of 2008 until 

August of 2012. 

Q. And you were with 210 the whole time? 

A. I went to 62nd MP detachment in February of 

2011 while I was there. 

Q. What's 62nd MP detachment? 

A. CID unit. 

Q. CID. What do you do as an MP with CID? 

A. For an MP is a drug suppression team. I was 

an investigator on the drug suppression team. 
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Q . While you were at Fort Drum did you meet PFC 
Manning? 

A. Yes, ma'am. 

Q. And how did you meet him? 

A. I met him when he first got there, when he 
first got to Fort Drum, he was looking for somebody's 
Internet to use. 

Q. Were you in the same unit? 

A. Yes, ma'am. We were in the same company. 

Q. Same company. Do you remember when that was? 

A . I don ' t remember the exact month . 

Q . Approximately . 

A. No, not approximately. 

Q. Do you remember when he arrived at the unit? 

A. I think it was around June or July of 2008. 

Q. 2008? 

A. Yes, ma'am. 

Q. And when was the next time you remember seeing 
PFC Manning? 

A. The next time I seen him was the first joint 



readiness training center rotation at Fort Polk, 
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Louisiana . 

Q. 
A. 

Q. 
A. 

time . 

Q 
A. 

Q 
A. 

Q 
A. 

Q 
A. 

Q 

A. 

Q 

A. 

Q 

A. 



So what ' s the joint readiness training? 

It 1 s training for your deployment . 

And what training do you receive? 

That one was geared towards Afghanistan at the 

Do you remember when that was? 

Yes, ma'am. That was September of 2008. 

And you said the accused was there? 

Yes, ma'am, he was. 

How do you know that? 

We slept in the same building. 

Did he also attend the training? 

Yes, ma'am, he did. 

Did your unit attend another JRT training? 
Yes, ma'am, we did. 

And do you remember when that was? 

That one was September of '09. 

What did that training focus on? 

That one was focused on Iraq, our deployment 



got changed to Iraq. 
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Q. Was the accused also at that training? 

A. Yes, ma'am, he was. 

Q. How do you know that? 

A. We slept in the same building again. 

Q. Do you remember when you deployed, do you 

remember what month that was? 



A 

Q 
A 

Q 

A 

Q 

A 

Q 



Yes, ma'am. It was October of 2009. 

And how long were you deployed for? 

From October of 2009 till August of 2010. 

And did you go with the rest of your unit? 

I was part of the advance, the torch party. 

Was that with 210? 

Yes. 

And what does it mean to be part of the torch 



party? 

A. We flew before the rest of the unit started 

flying. We arrived in Kuwait and we waited in Kuwait 
until the last group flew out to Iraq and we flew with 
the last group . 

Q. So how long was the rest of your unit in 

Kuwait? 
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A. I'd say about a week or two maybe at the most. 

Q. When did you arrive in Iraq? 

A. November of 2009. 

Q. And how about the majority of 210, do you know 

when they arrived? 

A. I think the end of October is when they should 

have been there. 

Q. What was your interaction with the accused 
during the deployment? 

A. He was my roommate. 

Q. Was that for the entire time you were 
deployed? 

A. Yes, ma'am, from about November of 2009 to May 
of 2010. 

Q. You were roommates the whole time? 

A. Yes, ma'am. 

Q. How are roommates assigned? 

A. Assigned by the first sergeant. 

Q. So you didn't choose your roommate? 

A . No , ma ' am . 

Q. Was the accused in theater for the entire 
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deployment ? 

A. Other than his leave, yes, ma'am. 

Q. Do you remember when he went on leave? 

A. Yes, ma'am. From the middle of January to — 

I don ' t know exactly when he came back because I went two 
weeks after he left . 



Q 
A 

Q 
A 

Q 

A 

Q 

A 

Q 

A 

Q 



How long is the amount usually? 

Usually for two weeks . 

Any travel time in there, too? 

Yes, ma'am, travel time is added to that. 

So do you know approximately when he returned? 

No , I do not . 

And when did you say you left? 
I left the end of January. 
And he wasn't back yet? 
No , ma ' am . 

And when did you come back? 

I came back the beginning, the first week of 



A 

March . 

Q. So you were gone for the entire month of 

February and into March? 
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A. Yes, ma'am. I got stuck in Kuwait on the way 

back . 

Q. Was the accused there when you returned? 

A. Yes, ma'am, he was. 

Q. What kind of — where did you sleep when you 

were in Iraq? 

A. I slept in an a CHU. 

Q. What's that? 

A. It's like a, it's like a trailer divided into 

three rooms . 

Q. How did you divide your room with PFC Manning? 

A. Our room was divided, my bed was by the door 

and his bed was by the back wall . We had two night 
stands, our stuff on separate sides. 

Q. Were you generally familiar with your 

roommate ' s belongings that he kept in the CHU? 

A. I'd say familiar at least what was in there. 

Q. And what kind of, do you remember what kind of 

computer equipment he had? 

A. Yes, ma'am. 

Q. And what was it? 
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A. He had a Mac Book Pro, a hard drive, I 

remember an iPod Touch, and a microphone with some 
headphones . 

Q . And you remember seeing all those in your 

room? 

A. Yes, ma'am. 

Q. Was that for the entire deployment? 

A. I'd say the hard drive I can't remember being 

there afterwards . 

Q. After what? 

A. After his leave. 

Q. You remember the Mac being there? 

A. Yes, ma'am. 

Q. And that was from November to May? 

A. Yes, ma'am. 

Q. Was there any, did your roommate keep any 

digital media in the CHU? 
A. Like CDs. 

Q. What kind of CDs? 

A. Like the blank CDs, like the standard CDs 

you'd get from your unit supply. 
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Q . And how many did he have around? 

A. I'd say about two cases. 

Q. How many are in a case? 

A. Usually five. 

Q. And do you remember any particular time that 

you noticed those CDs around? 

A. I don't remember the exact time that I noticed 

it. 

Q. Were any of them labeled? 

A . No , ma ' am . 

Q. And where were they usually kept or where were 

they kept? 

A. I think by the time I noticed them they were 

on like the night stand. 

Q. Did you ever use any of these discs? 

A. No, ma'am, I didn't. 

Q. And did you ever ask your roommate why he had 

so many of these rewritable discs? 
A. Yes, ma'am, I did. 

Q. Why did you ask him that? 

A. I just thought it was a little weird because 
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he had an iPod and so I was kind of confused. 

Q. What did he say when you asked him that? 

A. He said they were to bring music into the SCIF 

because he couldn't take his iPod in there. 

Q. Did you ever have any blank CDs in the CHU? 

A. No. 

Q. And did you ever see any blank CDs in the CHU 

marked secret? 

A . No , ma ' am . 

Q. Did you ever bring anything in the CHU marked 

secret? 

A . No , ma ' am . 

Q . And you mentioned a Mac Book Pro . Where did 

you say or did you say where he kept his laptop? 

A. No, ma'am. His laptop was beside his bed on 

the, I guess on a laptop stand facing his bed. 

Q. Did you ever use that laptop? 

A . No , ma ' am . 

Q. How often was that laptop in your room? 

A. I'd say every day from the time, from November 

from when I was there until May. 
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Q. Did you ever see your roommate using it? 

A. Yes, ma'am. 

Q. How often did he use it? 

A. Pretty much daily. 

Q. And were you two on the same shift? 

A. Before both of us had went on our block leave 

we were on the same shift . 

Q. And how about after? 

A. After it got changed up a little bit. 

Q. So how did you know that he used it daily? 

A. Beforehand we'd be on the same shift, pretty 

much use it I guess until he was going to sleep, and I'd 
say a few times like I ' d wake up and he ' d still be on it . 

Q. Did you ever see what he was doing on that 

computer? 

A . No , ma ' am . 

Q. What did your roommate do in his spare time? 

A. Used his computer, asked to go to the AP 

trailer, usually I see him sometimes at the smoke pit. 
Q. Did your roommate send a lot of packages? 

A. I wouldn't say sending a lot like — how do 
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you mean , ma ' am? 

Q. Was there ever a time when you noticed that he 

sent numerous packages? 

A. Yes, ma'am. It was only once though. 

Q. Okay. So one time. How many did you notice? 

A . I don ' t remember how many he sent . 

Q. Less than five? 

A. Yeah, I'd say probably about less than five. 

Q. And do you remember when that was? 

A. The end of April. 

Q. How do you remember that? 

A. Because everybody thought we were going home 

early, usually everybody will send packages around the 
same time . 

Q. Did you ever see any books about computers in 

your room? 

A. Not until after his belongings were taken out 

of the room. 

Q. Okay. Were they — so you did see books? 

A. Yes, ma'am. 

Q. Were they, they were his books? 
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A. 


I ' d assume so . 


Q. 


Were they yours? 


A. 


No , ma ' am . 


Q. 


Were they in your room? 


A. 


Yes, ma'am. 


Q. 


What kind of books did you see? 


A. 


Like Net Plus, C Plus and like Linux. 


Q. 


And what are those, do you know? 


A. 


Like hardware and software books . 


Q. 


When were you first contacted by CID for this 



particular case? 

A. The day they came and searched our room. 

Q. Can you tell us about that? 

A. Yes, ma'am. They came, they asked me to point 

out like which side was mine, which stuff was mine and 
which stuff was not mine. 

Q. And what did you tell them? 

A. I told them everything on the left side of the 

room, to the left, on the left of the night stand was 
mine, and everything on the right side was his. 

Q. Did the agents take any of your property? 
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A. No, ma'am, they didn't. 

MR. COOMBS: Your Honor, at this point the 
defense would stipulate that the items seized by the 
agents were my client ' s items and not the witness ' s 
items . 

THE COURT: All right. 

MS . OVERGAARD : Can we have a quick recess in 

place? 

THE COURT: Certainly. 
(BRIEF PAUSE . ) 

MS. OVERGAARD: No further questions, ma'am. 

Thank you . 

THE COURT: All right. 
Cross examination. 
MR. COOMBS: Yes, Your Honor. 
CROSS EXAMINATION 

BY MR. COOMBS: 

Q. Specialist Baker, how are you? 

A. I'm doing all right, sir. 

Q. Good. I just have a few questions for you. 

You indicated that you were one of the last individuals 
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to leave Kuwait and then get to Iraq, is that correct? 
A. Yes, sir. 

Q. And when you arrived, you were also one of the 

last people to get a roommate? 
A. Yes, sir. 

Q. And at the time you were assigned by the first 

sergeant to be PFC Manning's roommate? 
A. Yes, sir. 

Q. Because he was one of the last people who 

didn't have a roommate? 
A. Yes, sir. 

Q. Now, even though you're roommates, it's fair 

to say that you and PFC Manning weren't friends? 



A 

Q 
A 

Q 

A 

Q 



Yes, sir, it's fair to say. 

The two of you really didn't hang out? 

No, sir, we didn't. 

Didn ' t have much in common? 

No, sir. 

And the two of you really didn't talk very 



much? 



A. 



No, sir. 
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Q. You talked about some of the observations on 

direct of seeing where PFC Manning would go and what he 
would do . Fair to say that you didn ' t really see him 
hang out with too many people? 

A. No, sir, I didn't. 

Q. In fact, if he wasn't in his room on the 

computer, he was in the smoke pit, is that correct? 
A. Yes, sir, I would say that. 

Q. And when he was in the smoke pit he was by 

himself? 

A. Yes, sir, he was. 

Q. And if he wasn't in the smoke pit or on his 

computer in his room, he was going to the PX, right? 
A. Yes, sir. 

Q. And, again, going by himself? 

A. Yes, sir. 

Q. You said a couple times that you would wake up 

and you would see him on the computer? 
A. Yes, sir. 

Q. And he was essentially just typing? 

A. I don't remember exactly. Sometimes I just 
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assume like he was chatting with somebody, so I didn't 
pay attention. 

Q. So you saw him, what you thought was he was 

chatting with somebody? 

A. Yes, sir. 

Q. And from your observations, did PFC Manning 

seemed to spend most of his time on the computer? 
A. Yes, sir. 

Q. That seemed to be the main source of 

friendship that he had there? 
A. Yes, sir. 

Q. You talked about some items being sent back in 

April, is that correct? 
A. Yes, sir. 

Q. And that was basically because everyone kind 

of thought maybe we're going to go back in April, right? 
A. Yes, sir. 

Q. And people, not uncommon to pack up items you 

don't want to lug all the way back with you, you want to 
ship them back? 

A. Yes, sir. 
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MR. COOMBS: Thank you, Specialist Baker. 

THE COURT: Redirect? 

MS. OVERGAARD: No, ma'am. 

THE COURT: Temporary or permanent excusal? 

MS. OVERGAARD: Temporary, ma'am. 

THE COURT: All right. Specialist Baker, 
you're temporarily excused, please don't discuss your 
testimony or knowledge of the case with anyone other than 
counsel or the accused while the trial is still going on. 

You're free to return to the waiting room. 

For the record, although the government asked 
for a recess the court, the court did recess the court 
and I never called the called the court back to order. 

MS. OVERGAARD: Your Honor, at this time the 
United States has a stipulation of expected testimony of 
Sergeant Mary Amatoo . 

THE COURT : All right . Do you want to 

publish it? 

MS. OVERGAARD: Yes, ma'am. 
THE COURT: Go ahead. 

MS . OVERGAARD : It is hereby agreed by the 
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accused defense counsel and trial counsel that if 
Sergeant Mary Amatoo were present to testify during the 
merits and presentencing phases of this court-martial she 
would testify substantially as follows : 

I am currently the SI MCO for the Sixth 
Engineer Battalion at Fort Richardson, Alaska. I've held 
this position for two months . Previously I was the 
strength accounting clerk for U.S. Central Command Gl at 
Camp Arif jan, Kuwait. I held that position from October 
of 2011 until October of 2012. 

In that position I helped account for 
personnel coming in and out of theater, moving from place 
to place within theater and changing duty status . I 
provided battle management update briefs and worked with 
the deployed theater accounting system. I also worked 
with the joint asset movement management system. 

With regard to this particular investigation, 
I provided investigators from the Army Criminal 
Investigation Command, CID, a printout from JAMS on PFC 
Manning. JAMS is a system that captures movement and 
location information about operating forces, government 
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civil servants, and government contractors through data 
collection points established in specified operational 
theaters . 

These collection points are, for example, 
dining facilities, points of debarkation, and fuel 
points. Operational theaters include Kuwait, Afghanistan 
and Iraq. (INAUDIBLE) JAMS would record the dates PFC 
Manning scanned himself in and out of the Department of 
Defense, DOD, facilities using his card such as dining 
facilities, PX and points of debarkation into and out of 
Iraq, (INAUDIBLE) . 

When providing this report I also signed and 
notarized an attestation certificate identified as 
00412522 regarding the authenticity of the information. 

As a former strength accounting clerk I am 
familiar with JAMS reports. I've read them before. I 
therefore understand this JAMS report I provided 
identified as Bates numbers 004125233, 00412522 to show 
that the service member named Manning, Bradley, whose 
last four Social Security digits are 9504 came into and 
out of Iraq several times . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/3/13 Afternoon Session 



113 

For example, on page nine of this document, it 
shows that on 26 October 2010, PFC Manning signed into 
the (INAUDIBLE) in Kuwait, but by 28 October, 2010 was 
using the (INAUDIBLE) in Iraq. 

Page eight shows Bradley Manning departed 
Iraq on 28 January 2010, and then entered again via 
Kuwait on 11 February 2010. 

I'm going to repeat that sentence, ma'am, in 
case I read it wrong. 

Page eight shows Bradley Manning departed 
Iraq on 22 January 2010, and then departed again via 
Kuwait on 11 February 2010. Gaps like this are normal 
when a soldier leaves a deployment such as a (INAUDIBLE) . 
Page eight shows further that PFC Manning was using the 
FOB Hammer by (INAUDIBLE) . 

Lastly, page one showed that PFC Manning 
boarded an outbound flight from Iraq on 30 May 2010. 

And based on this stipulation, the government 
would like to offer what's been marked for, as 
prosecution exhibit 22 for identification as prosecution 
exhibit 2 2 , ma ' am . 
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MR. HURLEY: No objection. 

THE COURT: May I see it, please? 

Prosecution exhibit 22 for identification is 

admitted. 

Government, are you ready to call your next 
witness or do we need a recess? 

MR. FEIN: Your Honor, the United States 
requests a 15 minute recess and a brief 802 . 

THE COURT: All right. Any objection? 

MR. COOMBS: No objection, Your Honor. 

THE COURT: Court is in recess then until 

1635 or 4:35. 

(BRIEF RECESS . ) 

THE COURT: Is the government ready to 

proceed? 

MR. MORROW: Stipulation of expected 
testimony for Special Agent Calder Robertson. 

It is hereby agreed by the accused, defense 
counsel and trial counsel that if Special Agent Calder 
Robertson were present to testify during the merits and 
presentencing phases of this court-martial he would 
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testify substantially as follows : 

I am a special agent with the computer crime 
investigative unit, CCIU, of the U.S. Army criminal 
investigation command, CID. I have been with CCIU since 
March 2006. In February 2010 I became the special agent 
in charge, SAC, of the Europe branch office of CCIU. 

In my current capacity I am responsible for 
conducting and overseeing the conduct of large scale 
complex criminal investigations associated with high 
technology, including insider threat and computer 
intrusions into the critical information architecture of 
the United States Army. 

Among other things, this work includes 
conducting interviews, executing search warrants, 
processing crime scenes, collecting and handling physical 
evidence, obtaining forensic images of digital evidence, 
conducting forensic examinations and preparing 
comprehensive reports for supported officials and 
prosecutors . 

I have testified several times in judicial 
proceedings . Because I am in charge of the Europe branch 
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office of CCIU, I have responsibility for investigating 
cyber crime incidents in Europe and Africa as well as 
providing rapid response to southwest Asia, Iraq and 
Afghanistan . 

Additionally, I was recently selected to 
establish the Pacific branch office of CCIU with 
responsibility for investigating U.S. Army cyber crime in 
the Pacific. In April 1998 to October of 2003 I held 
(INAUDIBLE) that was responsible for investigating 
criminal offenses with an Army nexus . 

I received a bachelor's of science, BS, in 
psychology in 2006 and have been a certified computer 
crime investigator through the Defense Cyber Crime 
Center, DCCC, since 2007. In 2010 I was awarded the U.S. 
Army Chief of Battle for distinguished civilian service 
as a civilian special agent for Army CID . I received 
numerous other awards in my civilian and military 
capacities . 

I have received extensive training from the 
Defense Cyber Investigation Training Academy, DCITA which 
is part of DC3 . Through DCITA I have attended the 
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following courses relevant to my current work: Live 
network investigations, 2009; mobile electronics 
forensics training, 2008; advanced log analysis, 2008; 
forensics and intrusions in a Windows environment, 2007; 
Macintosh forensic examinations, 2007; wireless 
technology, 2007; windows forensic examinations with 
EnCase, 2007; introduction to networks and computer 
hardware, 2006; an introduction to computer search and 
seizure, 1999. 

Additionally, I attended computer forensics 
two with EnCase in 2009, a course put on by Guidant 
Software, the makers of EnCase. 

In 2011 I also attended DCITA large data set 
acquisition course as well as the Army criminal 
investigations laboratory ' s evidence management 
certification course. These courses focus on the 
collection and handling of physical and digital evidence . 

On 27 May 2010 I became involved with the 
investigation of PFC Bradley Manning after receiving 
preliminary information that required downrange 
investigation . As the SAC in charge of the Europe branch 
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office of CCIU and the closest CCIU agent to Iraq, I was 
tasked by CCIU headquarters then at Fort Belvoir, 
Virginia to provide support to the Camp Liberty CID 
office . 

I traveled to Camp Liberty in Baghdad and 
stayed there for three days at the end of May 2010. I 
stayed at Camp Liberty because at that time it was too 
dangerous to travel to FOB Hammer. Additionally, the 
evidence collection team already at the crime scene on 
FOB Hammer had sufficient personnel to complete their 
mission such that my physical presence was unnecessary. 

My role in the investigation was to assess 
and provide expert assistance with the collection, 
preservation and the imaging of computer evidence, as 
well as to perform preliminary analysis of the digital 
evidence . 

A preliminary forensic examination is a brief 
review taking no more than a couple of hours, whereas a 
full forensic examination may take anywhere from an 
entire day to several weeks depending on the amount of 
recoverable information . 
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I conducted preliminary forensic examinations 
on a number of items of evidence seized in this case. 
Evidence collected from FOB Hammer and delivered to me at 
Camp Liberty included two supply computers, a rewritable 
CD, an Apple brand personal laptop, an external hard disk 
drive and three sensitive compartmented information 
facility, SCIF, computers. 

I follow several general procedures when 
handling evidence . I review the custody document and 
always insure that the (INAUDIBLE) . I check, for 
example, the recorded serial numbers, markings for 
identification, and condition description match the 
associated evidence. I insure that the necessary 
information such as date and time are properly and 
accurately recorded. Lastly, I maintain secure custody 
of the evidence prior to transferring it to another 
individual . 

In addition to following these procedures, 
when transferring to or receiving evidence from another 
person I am also sure to properly sign, date and note the 
reason for the transfer. 
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With regard to each item of physical evidence 
I received in this case, I followed these same 
procedures. When receiving whole computers I also 
checked to insure they did not can contain any suspicious 
hardware or removable data storage devices such as SD 
cards and thumb drives . 

Prior to powering on or accessing the 
contents of any device I imaged each item of physical 
evidence I received in order to preserve the contents of 
the data on the item. 

If (INAUDIBLE) a forensic image on an item of 
digital media is an exact bit per bit copy of the 
(INAUDIBLE) without manipulating the data contained on 
the original evidence . This is standard practice by 
digital forensic examiners . 

The software forensic examiners use to image 
the digital evidence has built in procedures to verify 
that the item has been successfully duplicated. 

For example, the program will note the MD5, 
that's Mike Delta five hash, or secure hash algorithm 
one, SHAl, hash value of an item of digital evidence 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/3/13 Afternoon Session 



121 

before imaging acquisition hash value and after, if the 
two hash values match, the item has been successfully 
duplicated bit for bit . 

The hash value is determined by mathematical 
algorithm and is displayed as a number letter identifier 
unique to every item of electronically stored 
identification. It is similar to a digital fingerprint, 
although more unique. 

When a hash value is generated, the entire 
hard drive will have a hash value as well as each 
individual file on the hard drive. If there is any 
alteration to the hard drive or to any file on the hard 
drive, the acquisition and verification hash values will 
not match . The alteration can be as small as adding a 
single space into a text document, or saving a file in a 
different format, i.e., saving a dot doc as a dot PDF. 

In this case I used EnCase forensic software 
to complete this imaging process . EnCase is widely used 
by digital forensic examiners . 

As I stated earlier, I have received training 
on EnCase forensic software and have used it in my other 
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cases involving digital forensic examinations . I 
encountered no errors while conducting the imaging of the 
evidence at issue in this case. 

Between 30 May 2010 and 1 June 2010, I 
processed the following items of physical evidence : I 
processed a Hitachi brand laptop computer with the serial 
number 070817 Delta Poppa Charlie 10 Delta Sierra Gamma 
2 Juliet 1 Delta Poppa, which was collected from the 
supply office annex, Second Brigade, FOB Hammer, Iraq. 
This computer was marked unclassified and was seized 
because PFC Manning had temporarily worked in the supply 
office in May 2010 and used this computer. 

I received this evidence from Special Agent 
Thomas Smith. I followed proper evidence handling 
procedures to receive and handle this evidence and made 
sure the evidence matched its noted description before 
beginning work . 

Upon taking possession I unsealed this 
computer and obtained an EnCase present image of the hard 
drive contained within this computer . The resulting 
forensic image with the SHAl hash value of 309 D F 99 F 
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068 FBA2E 81 A A E 03 D L A 93 D 471 CD E 90 B F 
was verified to be an exact bit for bit copy of the hard 
drive through a comparison of the acquisition and 
verification hash values. I did not examine this image 
further . 

I reviewed DN073-10 in preparation for this 
case. This item's forensic image is located on item one 
of DN073-10 . I know this because I collected item one as 
evidence . 

B. I processed a Seagate brand computer hard 
drive with the serial number C N-0 M N 922-21232-793-002L 
which was collected from the supply office annex, Second 
Brigade combat team, Tenth Mountain team, FOB Hammer, 
Iraq. This computer was collected to the SIPRNET and the 
hard drive was seized because PFC Manning had temporarily 
worked in the supply office in May 2010 and used this 
computer . 

I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures to 
receive and handle this evidence and made sure the 
evidence matched its noted description before beginning 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/3/13 Afternoon Session 



124 



work . 

Upon taking possession I unsealed this hard 
drive and obtained an EnCase forensic image of the hard 
drive . The resulting forensic image with the SHAl hash 
value of C F 6 D 709 F 0023773 EB9E30EEB 318660 A 
C D 18 F 404 was verified to be an exact bit for bit 
copy of the hard drive through a comparison of the 
acquisition and verification hash values . I did not 
examine this image further. 

I reviewed DN-073-10 in preparation for this 
case. This item's forensic image is located on item D2 
of (INAUDIBLE) . I know this because I collected item two 
as evidence . 

C. I processed a rewritable compact disk 
CD-RW with the serial number L D 623 M J 04184038 B 16 
which was collected from the quarters of PFC Manning, 
room 4C93, LSA Dragon, FOB Hammer, Iraq. A CD-RW is 
different from a commercially produced CD with content 
already loaded on to it, i.e., from a music store, 
because a CD-RW allows the user to write content to the 
CD along with edit and delete information on the CD . 
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This CD-RW had a secret sticker on it and was labeled, 
quote, 12 July, JUL, 07, C Z, engagement zone, 30 G C, 
end quote . This CD-RW was collected with three Arabic 
language CDs in a multi disk case. I received this 
evidence from Special Agent Smith. 

I followed proper evidence handling 
procedures to receive and handle this evidence and made 
sure the evidence matched its noted description before 
beginning work . 

Upon taking possession I unsealed the multi 
disk case and took an EnCase forensic image of the 
aforementioned CD-RW. The resulting forensic image with 
the MD5 hash value (INAUDIBLE) . 5 C 993 E E 621 B 036482 
B A E 1353 F 844322 F was verified to be an exact bit for 
bit copy of the CD-RW through a comparison of the 
acquisition and verification hash values . 

After imaging this CD-RW, I conducted a 
preliminary forensic examination of this image . The 
CD-RW contained two files with identical names. One file 
contained no data and the other file, 12GUL07CG 
engagement zone 30 G C contained a video. The video 
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appeared to have been burned to the disk on 27 April 2010 
using Macintosh disk creation software . 

I reviewed DN073-10 in preparation for this 
case. This item's forensic image is located on item two 
of DN073-10. I know this because I collected item two as 
evidence . 

D. I processed an Apple brand laptop 
computer with the serial number W 8939 A Z 066 E which 
was collected from the quarters of PFC Manning, room 
4C93, LSA Dragon, FOB Hammer, Iraq. 

I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures 
through and received this evidence and made sure the 
evidence matched its noted description before beginning 
work . 

Upon taking possession, I unsealed the 
Macintosh computer and removed a Mitsubishi brand hard 
drive from the laptop and obtained an EnCase forensic 
image of the hard drive . The serial number of the hard 
drive was K 94 D T 9829 W P Y. The resulting forensic 
image of the hard drive I obtained from this computer 
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with the SHA1 hash value of 3 C F 107 DB8B3865A5E 
B F C E 400 B A E 1 D A 9691 F B 49 was verified to be an 
exact bit for bit copy of the hard drive through a 
comparison of acquisition and verification hash values . 

Thereafter, I conducted a preliminary 
forensic examination of this image . I determined that 
the hard drive had a Macintosh operating system installed 
and had a user account resembling PFC Manning's name, 
although I did not note the machine ' s user name in my 
analyst investigative report . 

A review of the device logs contained on the 
hard drive revealed some form of optical disk EIE CD R 
drive activity occurred, like deleting or burning CD-RW 
on or around 27 April 2010. 

I also reviewed the user files associated 
with the account resembling PFC Manning 1 s name and 
located several names containing text that was 
specifically during the initial phases of the 
investigation . Though I did not specifically note which 
text was referenced in the chat logs in my AIR. I 
reviewed DN073-10 in preparation for this case. This 
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item's forensic image is located on item one of 
DN073-1010. I know this because I collected item one as 
evidence . 

E. I processed a Seagate brand external hard 
disk drive, HDD, with the serial number 2GEWJKLJ, 
which was collected from the quarters of PFC Manning, 
room 4C93, LSA Dragon, FOB Hammer Iraq. 

I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures to 
receive and handle this evidence and made sure the 
evidence matched its noted description before beginning 
work . 

Upon taking possession I unsealed the 
external hard disk drive case and further removed the 
internal hard disk drive, also Seagate brand, serial 
number 9DS1S2TZ. Because I did not have a power 
adapter that could safely and reliably power the external 
Seagate drive . I then obtained an EnCase forensic image 
of the internal Seagate drive with the hash value of 
151183463 C 5 B 5841 A 8115627 BF51E8D9E 74A 3348. 

Resulting forensic image was deemed to be an 
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exact bit for bit copy of the Seagate hard disk drive 
through a comparison of the verification and (INAUDIBLE) . 

After imaging the Seagate hard disk drive I 
conducted a preliminary forensic investigation of this 
image . I found a file containing the contact information 
of a member of the WikiLeaks team, Mr. Julian Assange. 
This contact information appeared to have been produced 
and released by the WikiLeaks team and did not appear to 
be of a personal nature . 

I reviewed DN073-10 in preparation for this 
case. This item's forensic image is located on item one 
of DN073-10 . I know this because I collected item one as 
evidence . 

I processed an Alienware brand laptop 
computer with the serial number N K D 900 T A 6 D 00661 
which was collected from the sensitive compartmented 
information facility, SCIF, of the Second Brigade combat 
team, FOB Hammer, Iraq. This computer was connected to 
the SIPRNET and the hard drive was seized because PFC 
Manning had worked in the SCIF that November of 2009 to 
May 2010 and used this computer. 
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I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures to 
receive and handle this evidence and made sure the 
evidence matched its noted description before beginning 
work . 

Upon taking possession I unsealed the 
Alienware laptop computer, removed the Seagate brand hard 
drive from the laptop and obtained an EnCase forensic 
image of the hard drive . 

The serial number of the hard drive was 3 M H 
036 M 1. The resulting forensic image of the hard drive 
I obtained from this computer with the SHAl hash value of 
C 7400 FBEE0B4DB68A 582 A 585 EEAA34AB1 
A 62 CD 64 was verified to be an exact bit for bit copy 
of the hard drive through a comparison of the acquisition 
and verification hash values. 

Thereafter, I conducted a preliminary 
forensic examination of this image . I determined that 
PFC Manning had a user account on this laptop. I found 
several items of interest to this investigation including 
copies of the Apache video made publicly available by 
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WikiLeaks and called collateral murder. 

I also found an archive file that contained 
approximately 11,000 sensitive and classified documents 
downloaded in hypertext markup languages, HTML, 
language though I did not note the exact number. I 
reviewed (INAUDIBLE) in preparation for this case. This 
item's forensic image is located on item two of DN073-10. 
I know this because I collected item two as evidence . 

I processed a Dell brand laptop computer with 
the serial number H L B J Q F 1 which was collected from 
the sensitive compartmented information facility, SCIF, 
of the Second Brigade Combat Team, Tenth Mountain 
Division, FOB Hammer. This computer was connected in the 
SIPRNET and was seized because PFC Manning had worked in 
the SCIF and used this computer. 

I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures to 
receive and handle this evidence and made sure the 
evidence matched its noted description before beginning 
work . 

Upon taking possession, I unsealed the Dell 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/3/13 Afternoon Session 



132 

laptop computer, removed an unknown brand hard drive from 
the laptop and obtained an EnCase forensic image of the 
hard drive . The serial number of the hard drive was 5 M 
H H W K 9 . The resulting forensic image of the hard 
drive I obtained from this computer with the SHAl hash 
value of C 3473 C 3 D F 1 D 131 E 0022 F C 56 B F C 
4 6087 E 9 B 5150 F was verified to be an exact bit for 
bit copy of the hard drive through a comparison of the 
acquisition and verification hash values . 

Thereafter, I conducted a preliminary 
forensic examination of this image . I determined that 
PFC Manning had a user account on this laptop computer. 

I reviewed DN073-10 in preparation for this 
case. This item's forensic image is located on item two. 
I know this because I collected item two as evidence . 

I processed a Dell brand laptop computer with 
the serial number 93 H 4 Q D 1 which was collected from 
the sensitive compartmented information facility, SCIF, 
of the Second Brigade Combat Team, Tenth Mountain 
Division, FOB Hammer Iraq. This laptop had been located 
near the work area of PFC Manning. 
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I received this evidence from Special Agent 
Smith . I followed proper evidence handling procedures to 
receive and handle this evidence and made sure the 
evidence matched its noted description before begin 
beginning work. 

Upon taking possession I unsealed the Dell 
laptop computer, removed an unknown brand hard drive from 
the laptop and obtained an EnCase forensic image of the 
hard drive . 

The serial number of the hard drive was 5 M H 

T B 78. The resulting forensic image of the hard drive 

1 obtained from this computer with the SHAl hash value of 
E2B49BD3ED0E2F5D 798 A B 44 FEBAAC3B 
15 D 0070 D E was verified to be an exact bit for bit 
copy of the hard drive through a comparison of the 
acquisition and verification hash values . I did not 
examine this image further. 

I reviewed DN073-10 in preparation for this 
case. This item's forensic image is located on item one. 
I know this because I collected item one as evidence . 

As I stated earlier, I used the EnCase 
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forensic software to obtain images of each item of 
evidence I processed. In this case, I attached each 
device except the CD-RW to a write blocker and then 
attached the write blocker to my laptop computer which 
had the EnCase forensic software loaded. 

A write blocker is a device that allows you 
to acquire information on an item of digital media 
without accidentally damaging or the contents of the 
original digital media. In short, the write blocker 
insures that the (INAUDIBLE) is manipulated in any way. 

I did not use the write blocker when 
processing the CD-RW as that device was not at risk of 
alteration. Computers do not alter data on CD-RWs 
without specific instructions to do so. As I neither 
intended nor actually issued such instructions, there was 
no need to use a write blocker with regards to the CD-RW. 

After securing the write blocker as 
appropriate, I then used EnCase to create a forensic 
image of each item. As I stated earlier, EnCase 
(INAUDIBLE) that is later compared to the verification 
hash value once the image has been created. I saved the 
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forensic images of each device I processed on to sterile 
hard drives. I transferred items one and two on 
DN073-10 . 

When you open the forensic image in EnCase, 
EnCase itself verifies that the forensic image is a true 
copy . 

Item one of DN073-10, serial number 9 V S25 G 
M, is a Seagate brand hard disk drive containing the 
devices listed above that were initially determined to be 
unclassified . 

Item two of DN073-10, serial number 5 B G 
1826 C, is a Seagate brand hard disk drive containing the 
individual forensic images of the devices listed above 
that were initially determined to be classified secret. 

On 5 June 2010 I collected items one and two 
as evidence because I had previously transferred the 
forensic images of the various devices I processed to 
these two hard disk drives . I collected this evidence at 
the CID office on Camp Liberty. I did this to 
consolidate the evidence I processed for ease of review 
by subsequent forensic examiners . This process is 
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consistent with best forensic computer practices in the 
forensic community. It is common for investigators to 
consolidate the forensic images of multiple devices on 
one hard drive and then collect the resulting hard drive 
as evidence . 

After I collected items one and two as 
evidence, I transferred custody of this evidence to 
Special Agent Jeremy Drews . 

During the above forensic examinations I 
recorded my notes, including my description of the 
evidence and their related hash values on the AIR 
(INAUDIBLE) 00121674 through 00021683. This AIR 
accompanied the evidence I transferred to Special Agent 
Drews . 

The prosecution exhibit 11 for identification 
is a Seagate brand hard disk drive with a serial number 9 
BS 2 A G 5 M, item one of DN073-10. 

Prosecution exhibit 12 for identification is 
a Seagate brand hard disk drive with serial number 5 D 
826 C, item two of DN073-10 . 

MR. FEIN: May we have a moment, Your Honor? 
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Just to save seven pages worth of stipulation 
being read into the record, on page five of the written 
stipulation, Your Honor, serial number was given for the 
Dell brand laptop computer with the serial number H L V J 
Q F 1, and of the enclosed hard drive the serial number 
had it numbers transposed. The actual serial number is 5 
M H H W K N. 

THE COURT: Does the written stipulation of 
expected testimony, it's been already admitted, have the 
proper serial numbers? 

MR. FEIN: It does, Your Honor. 

Your Honor, the United States moves to admit 
prosecution exhibit 12 for identification. 

THE COURT: Those are the two hard drives 
represented in the stipulation? 

MR. FEIN: Yes, ma'am. 

THE COURT: Any objection? 

MR . COOMBS : No , ma ' am . 

THE COURT: Prosecution exhibits 11 and 12 
for identification are admitted. And I'm going to hand 
these back to the court reporter. 
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All right . Does the government have anything 
further to go forward with today? We spoke earlier, the 
parties came back for a brief RCM 802 conference and I 
believe it was the understanding of the parties that the 
next witness might be lengthy so starting him today might 
not be a good idea. 

MR. FEIN: Yes, Your Honor. The United 
States intends to call Special Agent Shaver first thing. 

THE COURT: Any objection? 

MR . COOMBS : No , Your Honor . 

THE COURT : Anything we need to address now 
before we recess the court? 

MR FEIN: No, Your Honor. 
MR . COOMBS : No , Your Honor . 

THE COURT: I do want to say something, there 
was some testimony elicited based on my questions from 
one of the earlier witnesses on something that I would 
instruct the members not to consider . I might consider 
everything just for the record. Both sides know what I'm 
talking about? 

MR. FEIN: Yes, Your Honor. 
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MR. COOMBS: Yes, Your Honor. 

THE COURT: Anything else we need to address? 
MR. FEIN: No, Your Honor. 
MR . COOMBS : No , Your Honor . 
THE COURT: Court is in recess. 
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